Updated 2026-09-19
Parses Zeek logs to detect SMB admin share access, DCE/RPC remote service execution, NTLM account spray, and anomalous internal connections.
Browse skills that share this capability.
Updated 2026-09-19
Parses Zeek logs to detect SMB admin share access, DCE/RPC remote service execution, NTLM account spray, and anomalous internal connections.