ATT&CK T1021.006 - WinRM HTTP Lateral Movement
This rule detects attempts to establish a TCP connection to port 5985 on the home network, which is commonly used for WinRM (Windows Remote Management) over HTTP. The rule is configured to alert if three such connection attempts are made from the same source within a 60-second window, indicating potential lateral movement activity using WinRM.
Suricata
