Possible Lateral Movement via WinRS

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potential lateral movement attempts through WinRS (Windows Remote Shell) where winrshost.exe spawns suspicious child processes like cmd.exe, powershell.exe, or other script interpreters. This pattern may indicate unauthorized remote command execution or administrative activities. WinRS is a legitimate Windows Remote Management tool but is commonly abused for lateral movement.

2025-03-14 00:00:00

None

bb7421be-4f23-4eeb-a603-1bbec62bed32

attack.lateral-movement attack.t1021.006

Nextron Sigma feed only (private)