Anomalous external DCOM/WinRM connection attempt (possible remote WMI abuse)
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Suricata
