How can I determine whether Remote Desktop hacking was successful?

Question

I noticed that my uplink bandwidth during a speed test seemed reduced, so I started investigating my network activity with Resource Monitor. I found that svchost.exe was transmitting ~2kB/sec (~16kb/s) to 209.7.101.10, reportedly Illinois Century Network, a backbone provider in Springfield, IL.

With process explorer I discovered that this svchost.exe PID was tied to an RDP session while I was logged in locally. I disabled remote desktop access and the process using the bandwidth immediately died. Of course my RDP port is open to the world, by design, so that I can access it away from home.

It appears clear to me that there were unauthorized attempts to access my PC remotely. How can I determine whether or not an RDP login attempt was successful?

I've checked in the TerminalServices-RemoteConnectionManager Operational logs and I can see what appears to be a smattering of common user names: "forms", "cecilia", "voicemail", "diane", etc. None of those accounts exist on my machine. Here's a sample entry:

Remote Desktop Services: User authentication succeeded:

User: diane
Domain: 
Source Network Address: 209.7.101.10

Mitigation

In the meantime, I've disabled remote desktop access. If I choose to restore it, I'll likely change the default port number at minimum. Anyone know how easy that would be to defeat via port scanning? A more secure method would be setting up SSH tunneling, though the Microsoft Android RDP client app doesn't support this.

Answer 1

Non-server editions of Windows only allow one user to be logged in at a time, so a successful login via RDP will kick you out and you will probably notice.

You can also find successful RDP login in the Security event logs by looking at the logon type. It is possible to use an XPath filter for this.

The bandwidth usage you're seeing is probably RDP serving the login screen. You can change the settings to require Network Level Authentication which validates the credentials before a connection can be made (no login screen).