RDPAudit — Windows RDP Security Monitoring & Auto-Block Platform#

RDPAudit is a production-ready Windows platform for monitoring RDP activity and responding to RDP-based threats.
It consists of a Windows Service (background event collection, 21 alert rules, automatic blocking) and a WinForms Configurator (GUI for management, statistics, diagnostics, and policy configuration).

Table of Contents#

• 1. Product Overview

  • 1.1. Purpose

  • 1.2. Solution Architecture

  • 1.3. Core Capabilities

• 2. System Requirements

  • 2.1. Minimum Requirements

  • 2.2. Windows Auditing Requirements

• 3. Solution Layout

  • 3.1. Projects and Layers

  • 3.2. Directory Structure

• 4. Quick Start

  • 4.1. Build

  • 4.2. Install the Service

  • 4.3. First Launch of the Configurator

• 5. RdpAudit.Service — Monitoring Service

  • 5.1. Event Collection

  • 5.2. Tracked Event IDs

  • 5.3. Data Storage (SQLite)

  • 5.4. Alerting System — 21 Rules

  • 5.5. Windows Firewall Auto-Blocking

  • 5.6. Named Pipe IPC

  • 5.7. Reliability and Resilience

• 6. RdpAudit.Configurator — GUI

  • 6.1. Overview Tab

  • 6.2. Prerequisites Tab

  • 6.3. Audit Policy Tab

  • 6.4. Service Tab

  • 6.5. Settings Tab

  • 6.6. Live Events Tab

  • 6.7. Firewall Tab

  • 6.8. Attack Statistics Tab

  • 6.9. Remote RDP Clients Tab

  • 6.10. AbuseIPDB Tab

  • 6.11. MikroTik Tab

  • 6.12. Logs Tab

  • 6.13. Diagnostics Tab

• 7. RdpAudit.Core — Shared Library

  • 7.1. Data Models

  • 7.2. Entity Framework Core and Migrations

  • 7.3. IPC Contracts (MessagePack)

• 8. External Integrations

  • 8.1. AbuseIPDB

  • 8.2. MikroTik RouterOS v7

• 9. Auto-Blocking Model

  • 9.1. Trigger Thresholds

  • 9.2. Local Windows Firewall

  • 9.3. Remote MikroTik Firewall

  • 9.4. Whitelist Protection for Trusted IPs

• 10. Data Maintenance

  • 10.1. Retention Pruning

  • 10.2. Backup and Restore

• 11. Security and Auditing

  • 11.1. Access Control

  • 11.2. SACL Configuration

  • 11.3. Secret Protection (DPAPI)

• 12. Configuration

  • 12.1. appsettings.json

  • 12.2. Environment Variables

• 13. Debugging and Diagnostics

  • 13.1. Console Mode

  • 13.2. Serilog Logs

  • 13.3. Direct SQLite Access

  • 13.4. Diagnostics Tab

• 14. Build and Test

  • 14.1. Build

  • 14.2. Tests

  • 14.3. Publish

• 15. Troubleshooting

• 16. Roadmap (v2.0 → v3.0)

• 17. License and Author

1. Product Overview#

1.1. Purpose#

RDPAudit is designed to provide continuous monitoring of RDP activity on Windows servers and workstations. The product runs in the background as a system service, even when no interactive user is logged on, records connection attempts, authentication events, and high-value system changes, evaluates them through 21 security rules, and can automatically block attackers through Windows Firewall and/or MikroTik RouterOS.

Typical use cases:

• Protecting Internet-exposed RDP endpoints from brute-force attacks

• Supporting SOC2, ISO 27001, and internal audit requirements for privileged access

• Detecting account compromise patterns such as a successful logon after repeated failures

• Identifying accessibility binary backdoors such as Sticky Keys and Utilman abuse

• Detecting attacks against LSA/LSASS, Kerberos spraying, and RDP port changes

• Integrating with MikroTik so malicious IPs can be blocked at the network edge

1.2. Solution Architecture#

┌──────────────────────────────────────────────────────────────────┐
│                     Windows Event Log                            │
│  Security │ TerminalServices-RemoteConnectionManager │ LocalSession│
└───────────────────────────┬──────────────────────────────────────┘
                            │  EventLogWatcher
                            ▼
┌──────────────────────────────────────────────────────────────────┐
│               RdpAudit.Service  (Windows Service)                │
│                                                                  │
│  EventCollectorWorker ──► EventNormalizerWorker                  │
│                                   │                             │
│                                   ▼                             │
│                         AlertEvaluatorWorker ──► 21 Alert Rules  │
│                                   │                             │
│                                   ▼                             │
│                         FirewallAutoBlockWorker                  │
│                         (Windows FW + MikroTik REST)             │
│                                   │                             │
│                                   ▼                             │
│                    SQLite  (WAL, %ProgramData%\RdpAudit)         │
│                                   │                             │
│                         Named Pipe IPC Server                    │
└───────────────────────────────────┬──────────────────────────────┘
                                    │  MessagePack over NamedPipe
                                    ▼
┌──────────────────────────────────────────────────────────────────┐
│              RdpAudit.Configurator  (WinForms GUI)               │
│                                                                  │
│  Overview │ Prerequisites │ AuditPolicy │ Service │ Settings     │
│  LiveEvents │ Firewall │ AttackStatistics │ RemoteRdpClients     │
│  AbuseIPDB │ MikroTik │ Logs │ Diagnostics                       │
└──────────────────────────────────────────────────────────────────┘

1.3. Core Capabilities#

• Real-time monitoring through EventLogWatcher subscriptions instead of polling

• 21 alert rules covering brute force, LSASS attacks, Kerberos spraying, suspicious policy changes, and more

• Automatic blocking using per-IP Windows Firewall rules with manual reversal support

• MikroTik integration through RouterOS v7 REST APIs with DPAPI-protected credentials

• AbuseIPDB reporting with local deduplication and rate-limit awareness

• Threat analytics aggregated by IP, country, time range, and calculated threat level

• Session-to-IP correlation for mapping RDP sessions back to source addresses

• Retention pruning for long-term stability and reduced database growth

• Backup and restore for configuration state, with no plaintext secrets included

• Secure Named Pipe IPC restricted to BUILTIN\Administrators

2. System Requirements#

2.1. Minimum Requirements#

2.2. Windows Auditing Requirements#

RDPAudit depends on Windows Security Auditing to receive the events it analyzes. For correct operation, the following audit categories must be enabled:

The Configurator applies these settings automatically by calling auditpol.exe with GUID-based identifiers, which makes the process locale-independent.

3. Solution Layout#

3.1. Projects and Layers#

3.2. Directory Structure#

RdpAudit.sln
├── src/
│   ├── RdpAudit.Core/
│   │   ├── Models/              — Entities, enums, projections
│   │   ├── Data/                — AppDbContext, EF Core migrations
│   │   ├── IPC/                 — MessagePack request/response contracts
│   │   └── Services/            — Shared scoring, formatting, and support services
│   ├── RdpAudit.Service/
│   │   ├── Workers/             — BackgroundService workers
│   │   ├── Alerts/              — 21 alert rules
│   │   ├── Firewall/            — Windows Firewall and MikroTik providers
│   │   ├── Collectors/          — Event source wrappers
│   │   └── Program.cs           — DI, Serilog, host wiring
│   └── RdpAudit.Configurator/
│       ├── Forms/               — 13 GUI pages
│       ├── IPC/                 — Named Pipe client
│       └── Program.cs           — Elevation, startup, UI bootstrap
├── tests/
│   ├── RdpAudit.Core.Tests/
│   ├── RdpAudit.Service.Tests/
│   └── RdpAudit.Benchmarks/
├── docs/
│   ├── 90-windows-validation.md
│   └── 91-troubleshooting.md
└── publish.ps1

4. Quick Start#

4.1. Build#

git clone https://github.com/paulmann/RDPAudit.git
cd RDPAudit
dotnet build RdpAudit.sln -c Release

4.2. Install the Service#

# Publish binaries
./publish.ps1

# Copy the service payload into Program Files
Copy-Item -Recurse publish/Service "$env:ProgramFiles\RdpAudit\Service"

# Install as a Windows Service manually, or use the Configurator UI
sc.exe create RdpAudit binPath= "$env:ProgramFiles\RdpAudit\Service\RdpAudit.Service.exe" start= auto
sc.exe description RdpAudit "RDP Security Monitoring & Auto-Block Service"
sc.exe start RdpAudit

4.3. First Launch of the Configurator#

publish/Configurator/RdpAudit.Configurator.exe

On first launch, the recommended sequence is:

1. Open Prerequisites and verify required channels and platform settings.

2. Open Audit Policy and apply the required audit subcategories through auditpol.exe.

3. Open Service and install or start the Windows Service.

4. Open Settings and tune alert thresholds, trusted IPs, retention, and integrations.

5. RdpAudit.Service — Monitoring Service#

5.1. Event Collection#

The service uses System.Diagnostics.Eventing.Reader.EventLogWatcher to subscribe to relevant events in real time. The design is already abstracted behind event source interfaces so the collection backend can later move to ETW-based ingestion without rewriting the rest of the pipeline.

Monitored channels:

• Security

• Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational

• Microsoft-Windows-TerminalServices-LocalSessionManager/Operational

5.2. Tracked Event IDs#

5.3. Data Storage (SQLite)#

The database is stored at %ProgramData%\RdpAudit\rdpaudit.db.

SQLite settings:

PRAGMA journal_mode = WAL;
PRAGMA synchronous = NORMAL;

Primary tables:

Write strategy: the hot path uses raw SqliteCommand with explicit transactions and batched writes.

Bookmark durability: bookmarks are flushed every 100 events and every 30 seconds, which minimizes loss after a crash or power interruption.

5.4. Alerting System — 21 Rules#

Each rule is implemented as a dedicated alert evaluator and participates in a common rule pipeline.

5.5. Windows Firewall Auto-Blocking#

When rules such as BRUTE_FORCE, BRUTE_FORCE_NTLM, or IP_REPUTATION are triggered, the service can create a per-IP inbound block rule.

netsh advfirewall firewall add rule `
  name="RdpAudit_Block_<IP>" `
  dir=in action=block remoteip=<IP> `
  protocol=any enable=yes

Implementation characteristics:

• Idempotent rule creation

• Input sanitization before shell execution

• Manual removal through the GUI

• Full auditing through ActiveBlocks and OperationLogs

5.6. Named Pipe IPC#

Pipe name: \\.\pipe\RdpAuditService

Security model: only BUILTIN\Administrators are allowed to connect.

Protocol: MessagePack request and response contracts defined in RdpAudit.Core.

Operational notes:

• The GUI never writes service-owned configuration files directly.

• Settings are sent over IPC and committed atomically by the service.

• Connection deadlines prevent the Configurator from hanging indefinitely.

5.7. Reliability and Resilience#

• Exponential backoff for transient database contention such as SQLITE_BUSY

• End-to-end CancellationToken propagation across async flows

• Graceful shutdown on service stop

• EF Core migrations applied at startup

• Event Log source registration during installation

6. RdpAudit.Configurator — GUI#

The Configurator runs elevated and communicates with the service strictly through the Named Pipe IPC channel.

6.1. Overview Tab#

The Overview tab is the operator dashboard. It summarizes service state, current block counts, recent alerts, and recent event volume.

6.2. Prerequisites Tab#

The Prerequisites tab checks the required Windows conditions:

• Audit channels enabled

• Terminal Services channels enabled

• Audit policy correctly applied

• Service installed and reachable

Each failed prerequisite can be fixed directly from the UI.

6.3. Audit Policy Tab#

The Audit Policy tab reads the current Windows audit configuration and applies the required subcategories through GUID-based auditpol.exe calls. It also handles SACL setup for high-value registry locations and IFEO paths tied to RDP abuse detection.

6.4. Service Tab#

The Service tab supports:

• Install and uninstall

• Start, stop, restart

• Service status display

• Startup mode control

6.5. Settings Tab#

The Settings tab exposes operational configuration, including:

• Alert thresholds

• Brute-force windows

• Work-hour definitions

• Data retention windows

• AbuseIPDB settings

• MikroTik settings

• Geolocation and whitelist settings

Changes are submitted over IPC and applied atomically by the service.

6.6. Live Events Tab#

The Live Events tab provides a tail-style stream of real-time events with color coding for failures, warnings, and successful activity. It supports filtering by Event ID and source IP.

6.7. Firewall Tab#

The Firewall tab surfaces active blocks from ActiveBlocks and supports:

• Viewing blocked IPs, reasons, and providers

• Manually adding block entries

• Removing blocks with confirmation

• Importing or exporting blocklists

6.8. Attack Statistics Tab#

The Attack Statistics tab presents aggregated attack data:

• Top attacking IPs

• Threat level scoring

• Time-based charts

• Country-level grouping

• CSV export support

Threat level is calculated through the scoring logic in AttackThreatScoring.

6.9. Remote RDP Clients Tab#

The Remote RDP Clients tab correlates source IPs, connection counts, usernames, and historical RDP sessions. It is intended to separate legitimate remote administration from noisy attack traffic.

6.10. AbuseIPDB Tab#

The AbuseIPDB tab manages:

• API key configuration

• Manual and automatic report workflows

• Report history with deduplication

• Rate-limit-aware status and validation

Secrets are never displayed back in plaintext.

6.11. MikroTik Tab#

The MikroTik tab configures RouterOS v7 REST integration:

• Router address and port

• DPAPI-protected credentials

• TLS validation behavior

• Address-list synchronization

• Connectivity testing

6.12. Logs Tab#

The Logs tab displays operational entries from OperationLogs, grouped by severity:

• Info

• Warning

• Error

• Critical

6.13. Diagnostics Tab#

The Diagnostics tab provides operator-facing health data:

• Worker state

• IPC health

• Database size and status

• Integration checks

• Diagnostic export support

7. RdpAudit.Core — Shared Library#

7.1. Data Models#

Key entities include:

7.2. Entity Framework Core and Migrations#

• EF Core 8 with SQLite

• AppDbContext for schema ownership and query support

• Automatic migration application at service startup

• EF Core reserved for configuration, migrations, and UI reads

• Hot-path writes handled through raw SQLite commands and explicit transactions

7.3. IPC Contracts (MessagePack)#

IPC requests and responses are serialized with MessagePack. Representative contracts include:

• GetStatusRequest / GetStatusResponse

• GetEventsRequest / GetEventsResponse

• GetFirewallBlocksRequest / GetFirewallBlocksResponse

• AddBlockRequest / AddBlockResponse

• RemoveBlockRequest / RemoveBlockResponse

• GetSettingsRequest / GetSettingsResponse

• SaveSettingsRequest / SaveSettingsResponse

• GetAttackStatsRequest / GetAttackStatsResponse

• GetOperationLogsRequest / GetOperationLogsResponse

8. External Integrations#

8.1. AbuseIPDB#

RDPAudit can report attacking IPs to AbuseIPDB when brute-force or high-confidence malicious behavior is detected.

Design notes:

• API keys are stored as DPAPI-protected values

• Duplicate reports are suppressed through local history

• Rate limits are respected

• Report categories are configurable

8.2. MikroTik RouterOS v7#

RDPAudit can push malicious IPs into a MikroTik address list through the RouterOS v7 REST API.

Design notes:

• Works over HTTPS REST endpoints

• Supports configurable TLS validation

• Stores credentials through DPAPI protection

• Avoids duplicate address-list entries

• Falls back gracefully when the router is unavailable

9. Auto-Blocking Model#

9.1. Trigger Thresholds#

Default behavior:

• 10 failed logons from the same IP within 10 minutes triggers a block

• Thresholds are configurable through Settings

• Whitelisted sources are excluded before a block is applied

9.2. Local Windows Firewall#

Provider: WindowsFirewallProvider
Action:   Create inbound rule "RdpAudit_Block_<IP>" (block, any protocol)
Reverse:  Remove rule by name
Verify:   netsh advfirewall firewall show rule name="RdpAudit_Block_<IP>"

9.3. Remote MikroTik Firewall#

Provider: MikroTikFirewallProvider
Action:   PUT /rest/ip/firewall/address-list { address: <IP>, list: "RdpAudit-Blocklist" }
Reverse:  DELETE /rest/ip/firewall/address-list/<id>
Verify:   GET /rest/ip/firewall/address-list?address=<IP>

9.4. Whitelist Protection for Trusted IPs#

• Supports single IPs and CIDR ranges

• Evaluated before any block is created

• Managed through the GUI

• Stored in WhitelistEntries with audit-friendly metadata

10. Data Maintenance#

10.1. Retention Pruning#

A pruning worker periodically deletes stale records.

Implementation notes:

• Batched deletes

• Exponential backoff on SQLITE_BUSY

• Cancellation support

• Operation logging

10.2. Backup and Restore#

The backup workflow captures configuration state, not the event database.

Included in backup:

• appsettings.json with DPAPI envelopes only

• Audit policy export

• Relevant registry keys

• Service configuration metadata

Not included:

• rdpaudit.db

A pre-restore safety snapshot is created before any restore operation is executed.

11. Security and Auditing#

11.1. Access Control#

11.2. SACL Configuration#

The Configurator sets SACLs on high-value targets so sensitive changes become auditable:

• IFEO accessibility keys

• RDP-Tcp registry configuration

• Lsa registry configuration

This supports detection of Sticky Keys backdoors, RDP port changes, and LSASS/PPL tampering.

11.3. Secret Protection (DPAPI)#

• AbuseIPDB keys and MikroTik credentials are protected with Windows DPAPI

• Only DPAPI envelopes are stored in configuration

• The GUI does not reveal plaintext secrets

• Backups include protected values, not decrypted ones

12. Configuration#

12.1. appsettings.json#

{
  "RdpAudit": {
    "DatabasePath": "%ProgramData%\\RdpAudit\\rdpaudit.db",
    "EnabledEventIds": ,
    "AlertRules": {
      "BruteForce": {
        "IsEnabled": true,
        "FailThreshold": 10,
        "WindowSeconds": 600
      },
      "OffHoursLogin": {
        "IsEnabled": true,
        "WorkHoursStart": "08:00",
        "WorkHoursEnd": "20:00",
        "WorkDays": ["Monday","Tuesday","Wednesday","Thursday","Friday"],
        "TimeZoneId": "UTC"
      }
    },
    "AutoBlock": {
      "IsEnabled": true,
      "Providers": ["WindowsFirewall"],
      "BlockTtlHours": 0
    },
    "Retention": {
      "RawEventsDays": 90,
      "AlertsDays": 180,
      "AttackStatsDays": 365
    },
    "AbuseIpDb": {
      "IsEnabled": false,
      "ApiKeyDpapi": "",
      "Categories": 
    },
    "MikroTik": {
      "IsEnabled": false,
      "Address": "",
      "Port": 443,
      "UsernameDpapi": "",
      "PasswordDpapi": "",
      "VerifyTls": true,
      "AddressListName": "RdpAudit-Blocklist"
    }
  },
  "Serilog": {
    "MinimumLevel": { "Default": "Information" },
    "WriteTo": [
      { "Name": "File", "Args": { "path": "%ProgramData%\\RdpAudit\\logs\\rdpaudit-.log", "rollingInterval": "Day" } },
      { "Name": "EventLog", "Args": { "source": "RdpAudit", "logName": "Application" } }
    ]
  }
}

12.2. Environment Variables#

You can override configuration values through environment variables, which is useful for automated deployment and diagnostics:

RDPAUDIT_RdpAudit__LogLevel=Debug
RDPAUDIT_RdpAudit__AlertRules__BruteForce__FailThreshold=5

13. Debugging and Diagnostics#

13.1. Console Mode#

When a debugger is attached, the service can run as a console application instead of a formal Windows Service.

cd src\RdpAudit.Service
dotnet run --configuration Debug

13.2. Serilog Logs#

Logs are written to:

• %ProgramData%\RdpAudit\logs\rdpaudit-<date>.log

• Windows Event Log → Application, source RdpAudit

To increase verbosity:

$env:RDPAUDIT_RdpAudit__LogLevel = "Debug"

13.3. Direct SQLite Access#

& "C:\Program Files\DB Browser for SQLite\DB Browser for SQLite.exe" `
  "$env:ProgramData\RdpAudit\rdpaudit.db"

Useful queries:

SELECT * FROM RawEvents ORDER BY TimeUtc DESC LIMIT 100;

SELECT * FROM ActiveBlocks WHERE Status = 'Active';

SELECT SourceIp, SUM(FailCount) AS Fails
FROM AttackStats
GROUP BY SourceIp
ORDER BY Fails DESC
LIMIT 20;

13.4. Diagnostics Tab#

The Diagnostics UI exposes:

• Events-per-second counters

• Worker status

• IPC state

• Database health

• External integration reachability

14. Build and Test#

14.1. Build#

dotnet build RdpAudit.sln -c Release
dotnet build src/RdpAudit.Service/RdpAudit.Service.csproj -c Release

14.2. Tests#

dotnet test RdpAudit.sln -c Release
dotnet test RdpAudit.sln -c Release --collect:"XPlat Code Coverage"
dotnet test tests/RdpAudit.Service.Tests/RdpAudit.Service.Tests.csproj

Each alert-rule test should validate:

1. Threshold boundary behavior

2. Whitelist bypass behavior

3. Zero managed allocations across repeated evaluations

14.3. Publish#

./publish.ps1

Expected output:

publish/
├── Service/
└── Configurator/

15. Troubleshooting#

Detailed guidance: docs/91-troubleshooting.md

See also: docs/90-windows-validation.md

16. Roadmap (v2.0 → v3.0)#

17. License and Author#

License: PolyForm Noncommercial License 1.0.0

Author: Mikhail Deynekin

• Website: deynekin.com

• Email: Mikhail@Deynekin.com

• GitHub: github.com/paulmann

Repository: github.com/paulmann/RDPAudit

Related resources:

• Technical Specification v1.0

• Technical Specification v2.0

• Issues and Feature Requests

© 2025–2026 Mikhail Deynekin. Released under the PolyForm Noncommercial License 1.0.0.