No, that event alone does not necessarily mean that an unauthorized person logged in to your server. Those events simply indicate that a TCP connection was established - it doesn't mean they entered valid credentials.
When you expose any service to the internet, you will see tons of random attempts to connect. All day, every day. Personally, I don't think exposing RDP to the internet is that dangerous, as long as you follow a few rules:
- Always stay up to date with security patches.
- Always use an extremely strong password.
- Rename your administrator account.
- Always have Network Level Authentication (NLA) enabled. This is the setting that says "Allow connections only from computers running Remote Desktop with Network Level Authentication (recommended)"
There have been a few security bulletins involving RDP over the last few years, but each time, the use of NLA mitigated the exploit. So never, ever turn it off.
The ultimate authority for knowing when someone has successfully logged on to your server or unsuccessfully tried to log on to your server is the old, trusty Security log.
You will no doubt see many Audit Failure type events in there that correspond to random people banging away at your server, just trying to guess your password.
Any time someone logs on successfully, an "Audit Success" type event will be recorded in the Security event log, event ID 4624, and it will say "An account was successfully logged on." Since you know they will have had to come in through RDP, since that is the only port open in your firewall, the Logon Type will be 2 (interactive.) 10 for "Remote Interactive"
Another event log that is probably easier to sift through is the "TerminalServices-RemoteConnectionManager" log. User logon events are recorded there, too. Look for Event ID 1149 which says
Remote Desktop Services: User authentication succeeded:
User: Administrator
Domain: COMPUTER
Source Network Address: 8.8.8.8
Now if you see an event like that, that you can't explain, then you can start worrying. :)