This event shows up multiple times within a minute like it was being brute-forced, but it says "authorized". My question is: Is there anyway I can see any commands that came in from this connection? I looked through my logs and files edited on that date but didn't find anything conclusive. System will get wiped soon so anything worth looking into pre-wipe would be good for future reference. I had my VPN open to the net for temp access if anyone was wondering how they got to the port in the first place.
I would like to thank everyone again for the help with the rep to post the pics, you guys rock, also anyone who took the time to view the topic thank you as well.
Back into event viewer seeing patterns I didn't notice the first round.
Hack started at 11/28 @ 1:35 am
The TerminalServices-RemoteConnectionManager the first log shows at 5:17pm
I notice USER32 reboots the system soon after group policies stops then event viewer is stopped:
Keep looking at all the hits the computer is logging. Then a bunch of service control manager processes.
Winhttproxy runs after a couple more hits, so I checked the proxy setting:
More hits flash crashes:
Honestly, I don't know what to make of the crash, whether it was an exploit to flash or just a regular flash instability.
I will make a VHD tonight and most likely wipe the machine. If anyone sees something or has any questions or settings they'd like me to check, it would be great. This is a good learning experience so any input is welcomed.