Remote Code Execution via Winrm.vbs
Detects an attempt to execute code or create a service on a remote host using `winrm.vbs` via `cscript.exe`. This technique leverages Windows Remote Management (WinRM) to interact with WMI for remote execution, often for lateral movement or persistence.
Sigma
