Well, you are getting there. Take small steps, that's all.
Your GREP would work … apart from two tiny things. The '+' at the end is not necessary! After any GREP command, you can add a 'repetition' code, which may be one of ?, *, or +, or an exact number or number range, like {5} or {3,6}. (And after that you can add another ?; this indicates that the lowest possible number of repetitions ought to be taken, rather than the largest number — which is the default setting.) In this case, I think that InDesign will interpret it as “5 digits-plus-a-period”, and then repeat this as much as possible, marking all possible sets of 5, rather than what you intended, only one set of 5.
The other thing is, you set a lower limit (the {5}) but you don't specify what ought to be next. So five digit-headings would be marked, but the first 5 of a six-digit heading as well. To prevent that, matching should stop right after the five you already have, and the easiest way is: because you don't want to find a match for a number after the 5th digit, it should match “not-a-digit” … (Obvious, really.) The code for not-a-digit is this: D, so your GREP will work like this:
^(d+.){5}D
There is a tiny, tiny catch: if 5 digits (and their periods) are matched, the character right after it (the I-Am-Not-A-Digit) will also be marked, because it's 'inside' the regular expression. Now in ordinary use, like bolding or italicizing the heading number, and assuming the next character will typically be a space, it won't really matter; but if you change the heading marker to be underlined, you will see the underlining stick out into the next character. So a slightly better version is, with the help of my little friend Lookahead:
^(d+.){5}(?=D)
meaning that it will find a set of 5 digits-plus-periods which must be followed by a Not-A-Digit character — the Lookahead matches, but does not mark, the text.
(This is a Positive Lookahead; there is also a Negative Lookahead, slightly more logical in this case:
^(d+.){5}(?!d)
— the same as above, only it now reads “.. which must not be followed by a digit”, which is more natural than the double negative.)
By the way #1: use d+, rather than d! Or else it will fail (silently) on “1.2.5.6.10. “
By the way #2: this forum eats backslashes for breakfast. Only feeding it a double breakfast makes it spit out a single one: type “\d” to get “d”. Be careful when editing your post, all double backslashes will appear as singles again.