Winrs Local Command Execution (bcfece3d-56fe-4545-9931-3b8e92927db1)
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.