Windows Event ID 4779 — A session was disconnected from a Window Station — SecOps Tools

Why event 4779 matters

Disconnected RDP sessions are targets for session hijacking via tscon.exe. Pattern: 4779 (disconnect from IP-A) + 4778 (reconnect from IP-B) = possible session theft.

How to detect it

Correlate 4779+4778 pairs where reconnect ClientAddress differs. Flag long-lived disconnected sessions (>8 h) on sensitive servers.

Log source

Security

Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

Fields to pivot on

SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName

MITRE ATT&CK mapping

Tactic	Technique
Lateral Movement	Remote Desktop Protocol (T1021.001)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

SecurityEvent
| where EventID == 4779   // A session was disconnected from a Window Station
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Security" EventCode=4779
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# A session was disconnected from a Window Station — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`

Hunt event 4779 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Related Logon/Logoff events

4624 An account was successfully logged on 4625 An account failed to log on 4626 User/Device claims information 4627 Group membership information 4634 An account was logged off 4647 User initiated logoff 4648 A logon was attempted using explicit credentials 4649 A replay attack was detected 4672 Special privileges assigned to new logon 4778 A session was reconnected to a Window Station 4800 The workstation was locked 4801 The workstation was unlocked

Frequently asked questions

What is Windows Event ID 4779?

A session was disconnected from a Window Station. An RDP session was disconnected (session remains active). Complements 4778 (reconnect).

Which log records event 4779?

Event 4779 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Logon/Logoff' subcategory (Success and/or Failure).

What MITRE ATT&CK techniques map to event 4779?

Event 4779 is associated with: Remote Desktop Protocol (T1021.001).

How do you detect activity around event 4779?

Correlate 4779+4778 pairs where reconnect ClientAddress differs. Flag long-lived disconnected sessions (>8 h) on sensitive servers.