Detecting lateral movement: SMB, PsExec, and the gap everyone has

Lateral movement (ATT&CK tactic TA0008) is where an intrusion stops being a nuisance and becomes a breach. It's also, repeatedly, the stage that produces telemetry but no alert.

Why SMB movement slips through

PsExec-style movement uses valid credentials over legitimate admin shares (ADMIN$, C$) and the Windows service control manager. Everything it touches is 'normal' administration. The events exist, Sysmon EID 1 for the spawned service binary, service-creation events (EID 7045), but many SIEMs collect them without a correlation rule that says 'this pattern, from this source, is lateral movement.'

What actually catches it

• Alert on remote service creation (EID 7045) where the binary path is unusual or in a temp directory.
• Correlate a network logon (Type 3) with an immediately following service install on the target.
• Baseline which accounts legitimately touch admin shares, and alert on the rest.
• Exercise the rule against real PsExec / SMB movement so you know it fires, not just that it exists.

That last point is the whole game. A rule you've never fired an attack at is a hypothesis. Running the technique in a range and watching the detection light up (or not) is the only way to know your coverage is real.