Storm-2603 WinRM Lateral Movement from SharePoint Server Process Context

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.