{"id":9851,"date":"2025-02-05T23:29:47","date_gmt":"2025-02-05T23:29:47","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=9851"},"modified":"2025-02-06T00:02:19","modified_gmt":"2025-02-06T00:02:19","slug":"dwrcsaccess-log-artifact","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2025\/02\/05\/dwrcsaccess-log-artifact\/","title":{"rendered":"DWRCSAccess.log artifact"},"content":{"rendered":"\n<p>I learned about DameWare&#8217;s <em>DWRCSAccess.log<\/em> log file from this <a href=\"https:\/\/rt-solar.ru\/solar-4rays\/blog\/5202\/\">blog post<\/a>. Then, when I searched this file name on Google I only got a very small number of <a href=\"https:\/\/www.google.com\/search?q=&quot;DWRCSAccess.log&quot;\">results<\/a>. Obviously, it immediately piqued my interest and I decided to describe the content of the file here. <\/p>\n\n\n\n<p>The content of this file is just a plain text, with parts of it often localized, and it looks like it contains the info about subsequent logging in events that are appended to the log file. <\/p>\n\n\n\n<p>The parts that are localized are language-specific &#8216;messages&#8217; that describe the reason why the metadata has been logged in a first place, and includes entries like these:<\/p>\n\n\n\n<ul>\n<li>The following user has connected via remote control.<\/li>\n\n\n\n<li>The following user has disconnected from remote control.<\/li>\n\n\n\n<li>Disconnected due to a time-out while waiting for a response for a shared session request.<br>Server closed the connection.<\/li>\n\n\n\n<li>Authentication Failed: Using Smart Card Logon. Please check previous event log entries for possible cause.<\/li>\n\n\n\n<li>Authentication Failed: Using Encrypted Windows Logon.<\/li>\n\n\n\n<li>Der folgende Benutzer ist durch Fernzugriff verbunden. (The following user is connected remotely.)<\/li>\n\n\n\n<li>Die Anmeldeerlaubnis wurde Ihnen nicht erteilt. Benutzer getrennt. (You have not been granted permission to log in. User disconnected.)<\/li>\n\n\n\n<li>etc.<\/li>\n<\/ul>\n\n\n\n<p>Then comes the actual metadata, which seems to be always stored in English and usually includes a set of the following, mostly self-explanatory fields:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Date:<br>Computer Name:<br>User ID:<br>Logon As ID:<br>Domain:<br>Desktop User ID:<br>Desktop Name:<br>System Settings Using:<br>Desktop State:<br>Permission Required:<br>Access Approved By:<br>Access Declined By:<br>Access Request Timeout:<br>Access Request Disconnected:<br>OS Product ID:<br>OS Registered Owner:<br>OS Registered Organization:<br>Host Name from Peer:<br>IP Address(es) from Peer:<br>Peer Host Name:<br>Peer IP Address:<br>Protocol Version - DWRCC.EXE:<br>Protocol Version - DWRCS.EXE:<br>Product Version - DWRCS.EXE:<br>Product Version - DWRCC.EXE:<br>Proxy Host Used:<br>Proxy Host:<br>Proxy Destination Host:<br>Proxy Destination Port:<br>Proxy Callback Port:<br>Authentication Type:<br>Last Error Code:<br>Last Error Code (WSA):<br>Host Port Number:<br>Host IP Address:<br>Host Name:<br>Absolute timeout setting:<br>Connect\/Logon timeout setting:<br>Access Check:<br>Registered:<br>WTS Session:<br>Used RSA Public-Key Key Exchange (1024 bit keys).<br>Encryption IDs:<br>Hashing IDs:<br>Used Shared Secret:<br>Registration:<\/pre>\n\n\n\n<p>Some of these may be containing a crucial information about the attackers that may not be present anywhere else.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I learned about DameWare&#8217;s DWRCSAccess.log log file from this blog post. Then, when I searched this file name on Google I only got a very small number of results. Obviously, it immediately piqued my interest and I decided to describe &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2025\/02\/05\/dwrcsaccess-log-artifact\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[19,128],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9851"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=9851"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9851\/revisions"}],"predecessor-version":[{"id":9854,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/9851\/revisions\/9854"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=9851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=9851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=9851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}