Merge pull request #204 from AndrewRathbun/master

Create Microsoft-Windows-RemoteDesktopServices-RdpCoreTS-Operational_…
EricZimmerman · Jul 27, 2022 · 61d4614 · 61d4614
2 parents 9d9dc21 + 1003abc
commit 61d4614
Showing 1 changed file with 36 additions and 0 deletions.
diff --git a/...pServices-RdpCoreTS-Operational_Microsoft-Windows-RemoteDesktopServices-RdpCoreTS_104.map b/...pServices-RdpCoreTS-Operational_Microsoft-Windows-RemoteDesktopServices-RdpCoreTS_104.map
@@ -0,0 +1,36 @@
+Author: Andrew Rathbun
+Description: Client timezone bias from UTC
+EventId: 104
+Channel: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational
+Provider: Microsoft-Windows-RemoteDesktopServices-RdpCoreTS
+Maps:
+  -
+    Property: PayloadData1
+    PropertyValue: "TimeZoneBias: %TimezoneBiasHour%"
+    Values:
+      -
+        Name: TimezoneBiasHour
+        Value: "/Event/EventData/Data[@Name=\"TimezoneBiasHour\"]"
+
+# Documentation:
+# <Event>
+#   <System>
+#     <Provider Name="Microsoft-Windows-RemoteDesktopServices-RdpCoreTS" Guid="1139c61b-b549-4251-8ed3-27250a1edec8" />
+#     <EventID>104</EventID>
+#     <Version>0</Version>
+#     <Level>4</Level>
+#     <Task>4</Task>
+#     <Opcode>15</Opcode>
+#     <Keywords>0x4000000000000000</Keywords>
+#     <TimeCreated SystemTime="2022-06-19 22:13:24.3764706" />
+#     <EventRecordID>147284</EventRecordID>
+#     <Correlation ActivityID="f420b856-485f-46cb-bc3f-fc215da30000" />
+#     <Execution ProcessID="1337" ThreadID="5832" />
+#     <Channel>Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational</Channel>
+#     <Computer>HOSTNAME.domain</Computer>
+#     <Security UserID="S-1-5-20" />
+#   </System>
+#   <EventData>
+#     <Data Name="TimezoneBiasHour">[-7]</Data>
+#   </EventData>
+# </Event>