Potential Lateral Movement via Windows Remote Shell Child Process
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRS) and may indicate potential lateral movement activity. The rule specifically filters out 'conhost.exe' as a common benign child process.
Sigma
