Audit success in event log from not administrator IP - is that immediately a hack success indicator?
- by Valentin Kuzub
I checked event log today and between mass of failed audit events I found some successes which originated from not my country. However they look a little weird and no process is specified, while when I logon using RDP it says winlogon.exe
I am wondering whether that means my system was compromised or there are good variants and it doesnt mean its all that bad.
I am using a VPS solution if thats useful.