I'm analyzing several hacked machines on our network. On the original hacked machine, I've found event logs indicating a series of successful RDP connections to other machines, but when I go to those machines and check the RDP connection logs, I don't see any logs at all around that time period. I also don't see much in the security or application log except for DWM sessions starting.
I know that functionality to delete specific events from the log is not exposed, but do you know of any tools that can modify event log exports? I'm thinking maybe the log was backed up and cleared and then the backup was tampered with before restoring or something like that. Otherwise, I'm not sure how I could have logs on one machine but only have logs before and after on the others.