Alright I figured out that the
task scheduler application that comes with windows is configurable to where I can run a batch script, triggered when an event in the event log is generated. Via the UI you choose the event type, event source and event ID, in which case I used 4264 (and yes is captures all logon types). Here I used a simple batch script instead:
netstat -n | find ":3389" | find "ESTABLISHED">>%logfile%
Also I found a this super-useful example on how to subscribe/listen to event writes in .NET:
I'm gonna end up using that instead to to write certain events to to a database for web-based examination.