Rule Info
Name
Potential Lateral Movement via Windows Remote Shell
Author
Liran Ravich
Description
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.
Date
2025-10-22 00:00:00
Modified
None
Id
79df3f68-dccb-48e9-9171-b75cbc37c51d
Tags
attack.lateral-movement attack.t1021.006
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR