ATT&CK T1021.006 - WinRM HTTPS Lateral Movement

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to establish a WinRM HTTPS connection (port 5986) to a host on the home network. It specifically looks for TCP SYN packets (flags:S) and triggers if three such connection attempts are made from the same source within 60 seconds. This pattern can indicate lateral movement activity using WinRM over HTTPS.