# 🦀 Detecting Lateral Movement

After compromising one machine, attackers move sideways to find the Crown Jewels (Domain Controller).

## 📝 The Raw Log (PsExec Event)

```xml
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'>
  <System>
    <EventID>7045</EventID>
    <Computer>HR-LAPTOP-04</Computer>
  </System>
  <EventData>
    <Data Name='ServiceName'>PSEXESVC</Data>
    <Data Name='ImagePath'>%SystemRoot%\PSEXESVC.exe</Data>
    <Data Name='ServiceType'>user mode service</Data>
    <Data Name='StartType'>demand start</Data>
    <Data Name='AccountName'>LocalSystem</Data>
  </EventData>
</Event>
```

## 🕵️‍♂️ Investigation Steps

### Step 1: Analyze Event 7045
* **Event 7045**: A new service was installed.
* **ServiceName**: `PSEXESVC`.
* **Significance**: This is the default service name for **PsExec**, a tool often used by admins but LOVED by hackers for moving laterally.

### Step 2: Contextualize
* Did authorized IT staff deploy software at this time?
* If NO, an attacker effectively "remote controlled" this machine from another infected host.

### Step 3: Find the Source
* Look for successful network logins (Event 4624, Type 3) occurring just before this event to find the **Patient Zero** IP.
