Alright I figured out that the
task scheduler application that comes with windows is configurable to where I can run a batch script, triggered when an event in the event log is generated. Via the UI you choose the event type, event source and event ID, in which case I used 4264 (and yes is captures all logon types). Here I used a simple batch script instead:
netstat -n | find ":3389" | find "ESTABLISHED">>%logfile%
Also I found a this super-useful example on how to subscribe/listen to event writes in .NET:
I'm gonna end up using that instead to to write certain events to to a database for web-based examination.
The only drawback of this solution is that if you have Remote Desktop Services enabled and multiple people are connected, you cannot differentiate between them in the netstat output.