detecting-lateral-movement-with-zeek - Detecting Lateral Movement with Zeek
Analyze Zeek network logs to detect lateral movement including SMB share access, DCE/RPC service execution, and NTLM account spray.
Tags
Updated: 2026-09-19Capabilities
Typical Outputs
What this skill does
- Verify Zeek log collection
- Parse conn.log for lateral connections
- Analyze SMB admin share access
- Detect DCE/RPC remote service operations
- Detect NTLM account spray activity
- Run automated analysis script
Inputs
- Zeek log files
- Zeek log directory path
- Agent analysis script agent.py
Outputs
- notice.log alerts
- Analysis execution results
Requirements
- Zeek 6.0+
- Zeek SMB analyzer enabled
- Zeek DCE/RPC analyzer enabled
- Zeek Kerberos analyzer enabled
- Python 3.8+
- Access to Zeek log directory
