Local Account WinRM Authentication Attempt
This rule detects multiple WinRM authentication attempts using basic authentication from a single source IP address to the local network. It specifically looks for the 'Authorization: Basic' header in TCP traffic destined for port 5985 (default WinRM port) and triggers an alert if five such attempts occur within 30 seconds from the same source.
Suricata
