Kusto Query: Clipboard access during RDP session

SuryaJ 

The RDP Session query does not have DLL information in it. I am operating on the fact that the RDP Session will provide a LogonId (session ID) variable that I can than filter on in the Clipboard query (the default found in MS Sentinel), so that the intersection of the two provides a manageable number of results.

I cannot post actual data due to security concerns, however, the RDP session data looks like this:

Device Name     RemoteDeviceName     LogonId     RemoteIP     RemoteIPType     RemotePort     Count

<computername>     <blank>     <6222631367>     10.xxx.xxx.xxx     Private     <port number>     1

If I try to add this line after line 4 to the query:

| where ActionType contains "GetClipboardData"

I get zero hits ("No results found in the specificed time frame."); this may not be an indication of an incorrect query, rather it could mean there just aren't any RDP sessions with the DLL call. However, I doubt that is the case.