Windows Event ID 4778 — A session was reconnected to a Window Station — SecOps Tools

Why event 4778 matters

RDP session hijacking (tscon.exe with SYSTEM privs) generates this. Also indicates RDP lateral movement. Monitor ClientAddress for unexpected geographic or network origins.

How to detect it

Alert: ClientAddress outside expected network ranges. Correlate with 4624 Type 10. Watch for reconnects without a prior 4624 from same IP (possible hijack).

Log source

Security

Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Lateral Movement	Remote Desktop Protocol (T1021.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 4778   // A session was reconnected to a Window Station
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=4778
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A session was reconnected to a Window Station — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4778 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4779 A session was disconnected from a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4778?

A session was reconnected to a Window Station. An RDP session was reconnected. ClientName and ClientAddress identify the source of reconnection.

Which log records event 4778?

Event 4778 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4778?

Event 4778 is associated with: Remote Desktop Protocol (T1021.001).

How do you detect activity around event 4778?

Alert: ClientAddress outside expected network ranges. Correlate with 4624 Type 10. Watch for reconnects without a prior 4624 from same IP (possible hijack).