T1021.002Lateral Movement

SMB / Windows Admin Shares

Once an attacker has admin credentials, SMB admin shares (ADMIN$, C$) are the highway to the rest of the domain. This is the classic PsExec move, and one of the most commonly missed. Here is how to catch it.

Run it live: Phishing to Lateral Movement

Two workstations and a DC on a real domain. Move laterally over SMB with harvested credentials and watch remote service creation (7045) and logon type 3 land in Wazuh.

Launch it

Windows exposes hidden administrative shares (ADMIN$, C$, IPC$) on every host for management. With valid admin credentials, an attacker uses them to copy a payload and execute it remotely, the mechanism behind PsExec, `smbexec`, and `wmiexec`. It is fast, uses built-in protocols, and blends into admin traffic, which is exactly why it is the lateral-movement step defenders miss most often.

What it looks like

Classic PsExec-style execution installs a temporary service on the target to run the payload as SYSTEM. That writes Event ID 7045 (A new service was installed) in the System log, usually with a random-looking service name and a binary path in a temp or share location. Alongside it you see a network logon, Event ID 4624 Logon Type 3, from the source host, and the file landing on ADMIN$.

System log EID 7045: new service with a random 8-char name, ImagePath in \\ADMIN$ or %TEMP%.
Security EID 4624 Logon Type 3 with the admin account from the attacker host.
Sysmon EID 11: PSEXESVC.exe or a random .exe written to C:\Windows.
smbexec/wmiexec variants: cmd.exe /Q /c ... > \\127.0.0.1\ADMIN$\__output redirection.

Detect it: Sigma

sigma / psexec-service-creation.yml

title: PsExec-style Remote Service Installation
id: 0f1a2b3c-smb0-4d5e-6f70-tyrian000004
status: stable
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
  service_name:
    ServiceName|re: '^[A-Za-z0-9]{8}$'    # random service name
  image_path:
    ImagePath|contains:
      - '\\ADMIN$\'
      - '\\PSEXESVC'
      - '\\Windows\\Temp\\'
      - '-s cmd'
  condition: selection and (service_name or image_path)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002

Detect it: Wazuh

wazuh / local_rules.xml

<group name="windows,lateral_movement,attack,">
  <rule id="100210" level="12">
    <if_group>windows_system</if_group>
    <field name="win.system.eventID">^7045$</field>
    <field name="win.eventdata.imagePath">ADMIN\$|PSEXESVC|\\Temp\\.*\.exe</field>
    <description>Lateral movement: remote service install (PsExec-style, T1021.002)</description>
    <mitre>
      <id>T1021.002</id>
    </mitre>
  </rule>

  <!-- Correlate with a network logon from the same source in the same window -->
  <rule id="100211" level="13" frequency="1" timeframe="60">
    <if_matched_sid>100210</if_matched_sid>
    <if_group>windows_security</if_group>
    <field name="win.system.eventID">^4624$</field>
    <field name="win.eventdata.logonType">^3$</field>
    <description>Lateral movement: remote service + network logon correlated</description>
    <mitre>
      <id>T1021.002</id>
    </mitre>
  </rule>
</group>

Reduce the surface

Enforce the local admin password solution (LAPS) so one stolen admin password doesn't open every host.
Restrict which accounts can log on over the network (Logon Type 3) to servers.
Segment so workstations can't reach each other's SMB, only the servers that need it.
Alert on 7045 with random service names, and measure detection latency against a real PsExec.

Tyrian's Phishing to Lateral Movement scenario spans two workstations and a DC on a real domain. You move laterally over SMB and watch 7045 and the Type 3 logon land in Wazuh, so you learn whether this common gap is a gap in your SOC too.

Test this detection on your own SIEM

Launch the Phishing to Lateral Movement range, fire T1021.002, and measure how fast you catch it. $5 free credit, no card.

Start free More techniques