Suspicious Execution of Winrs Local Command (via process_creation)

This rule detects the execution of Winrs.exe where it is leveraged to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.