splashtop

[randomaccess3]

Description

Checklist:

Please replace every instance of [ ] with [X]

• I have ensured a Provider is listed for the new Map(s) being submitted
• I have ensured the filename(s) of any new Map(s) being submitted follows the approved format, i.e. Channel-Name_Provider-Name_EventID.map (all spaces and special characters are replaced with a hyphen)
• I have tested and validated the new Map(s) work with my test data and achieve the desired output
• I have provided example event data at the bottom of my Map(s)
• I have consulted the guide/template to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!

[AndrewRathbun]

@randomaccess3 nice work, thanks for the contribution! I added the Documentation header in both Maps in case documentation is located in the future, the N/A can be replaced with link(s).

[randomaccess3]

Cool. I went looking but couldn't find anything online.

Interestingly these were paired with local session manager logins with remote host "LOCAL"