EventID:5156 ((SourcePort:3389 (DestAddress:127.* OR DestAddress:\:\:1)) OR (DestPort:3389 (SourceAddress:127.* OR SourceAddress:\:\:1))) (-(FilterOrigin:AppContainer\ Loopback OR (Application:\\thor.exe OR Application:\\thor64.exe)))