SOC Event Lookup
Event ID 4778LogonP3

Windows Event ID 4778: A session was reconnected to a Window Station

Applicable version
Windows Server 2008 and later where the audit subcategory is enabled
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4778 records reconnection to an existing Terminal Services, Fast User Switching, or Hyper-V Enhanced Session desktop session.

Technical Metadata

Technical metadata for Event ID 4778
Event ID4778
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0008 Lateral Movement / T1021.001 Remote Services: Remote Desktop Protocol
Key fields to watchAccount Name / Account Domain / Logon ID, Session Name, Client Name / Client Address

Trigger Scenarios

Microsoft documents that this event is generated when a user reconnects to an existing Terminal Services session or switches to an existing desktop.

Key Fields

Account Name / Account Domain / Logon ID

The user and hexadecimal session identifier associated with the reconnect.

Session Name

The terminal session name such as RDP-Tcp#0.

Client Name / Client Address

The reconnecting endpoint. Client Address is the concrete source for RDP session-return investigation.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4778
SecurityEvent
| where EventID == 4778
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields described on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4778
index=wineventlog source="WinEventLog:Security" EventCode=4778
| table _time, host, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
Cortex XQL: Retrieve Windows Security Event ID 4778
dataset = microsoft_windows_raw
| filter edr_event_id = 4778
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4778
title: Windows Security Event ID 4778
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4778
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
SessionNameRDP-Tcp#0An example Remote Desktop session name in the Microsoft event reference.Interpret SessionName with the other documented fields and correlated events; this value alone is not proof of compromise. Source
ClientAddressnetwork addressThe source address from which the existing session was reconnected.Interpret ClientAddress with the other documented fields and correlated events; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1021.001Remote Services: Remote Desktop Protocol

Detection Notes

Alert when Client Address is a new external or VPN source for a privileged Account Name and Session Name is RDP-Tcp#0 or another RDP session. Microsoft documents Client Address and Session Name for 4778; reconnecting to an existing session can let T1021.001 Remote Desktop Protocol activity resume without a fresh interactive 4624 Type 10 pattern. Correlate Logon ID with 4624, 4779, and command execution after reconnection.

Common False Positives

  • Normal RDP reconnects after network interruption or user lock/unlock activity.
  • Hyper-V Enhanced Session reconnects can generate the same event.

Related Events

Sample Log

Sanitized event sample
EventID: 4778
Account Name: admin
Account Domain: CORP
Logon ID: 0x169e9
Session Name: RDP-Tcp#0
Client Name: LAPTOP42
Client Address: 10.42.42.211

Frequently Asked Questions

What does Windows Event ID 4778 mean?

A user reconnected to an existing Window Station session.

Does Event ID 4778 always indicate malicious activity?

No. Normal RDP and Fast User Switching activity can generate it.

How should Event ID 4778 be investigated?

Review AccountName, SessionName, ClientAddress, and LogonId, then correlate with 4624 and 4779.

Sources