What logs may show remote access?¶
Remote access may be recorded across several systems rather than in one complete log.
Avoid the dangerous assumption¶
The dangerous assumption is that the remote-access product’s own history contains every relevant event.
It may not.
Useful records may include:
- application session logs
- operating-system login events
- identity-provider records
- VPN or gateway logs
- RMM platform logs
- firewall and proxy data
- process creation
- service and task logs
- file-transfer records
- cloud audit logs
- web-server logs
- security alerts.
Investigators should identify the access route.
A remote desktop connection through a VPN may produce records in the VPN, identity platform, operating system and endpoint product.
A support tool may record the operator account, while the device records the local process and user context.
A web shell may appear in web logs and process activity rather than in a conventional remote-access log.
Ask for:
- session start and end
- account identifiers
- source and destination details
- device or host identifiers
- authentication method
- session ID
- commands or actions
- file transfers
- disconnection or termination reason
- time zone.
Check retention and whether logging was enabled at the relevant time.
Do not assume that a missing log proves no access occurred. Products may have limited retention, logging gaps or local records that were deleted.
Likewise, one connection record may represent a gateway or relay rather than the final controller.
Native product logs may use different time zones or record connection, authentication and action times separately. Preserve the original timestamps and avoid merging them into one event without explanation.
Operational takeaway¶
Map the remote-access route across application, identity, network and endpoint logs, and use shared identifiers to correlate the session.