Potential Lateral Movement via Windows Remote Shell — Detection Rule
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.