## Exercise: Lateral Movement (T1021)

**Objective**: Detect movement between machines using SMB/Windows Admin Shares.

### The Attack (Atomic T1021.002)
*   **Command**: `net use \TargetIPC$ /user:Admin Pa$$word`
*   **Context**: Mapping the C: drive of a remote computer.

### The Detection
1.  **Event ID**: 4624 (Logon) Type 3 (Network).
2.  **Event ID**: 5140 (Share Access).
3.  **Share Name**: `\*C$`, `\*ADMIN$`, `\*IPC$`.

### SIEM Search
`index=windows EventCode=5140 ShareName="*C$" AccountName!="*$" `
(Exclude computer accounts ending in $).

### Analysis
Why is "Mary" mapping the C$ drive of "Bob"?
*   If Mary is HelpDesk -> Maybe okay.
*   If Mary is HR -> **Malicious**.