Lateral movement

Attackers almost never land where they want to be. They arrive on some ordinary laptop and then move sideways towards what they actually came for.

That movement is the part with the most opportunity to catch them, because it takes time and it looks unusual. A workstation that suddenly starts connecting to servers it has never touched is a strong signal. Increasingly the movement uses stolen credentials rather than exploits, which means it looks like a legitimate user doing legitimate things, just the wrong user in the wrong place.