LogoClawIndex
CasesSkillsAbout
LogoClawIndex

detecting-lateral-movement-with-zeek - Detecting Lateral Movement with Zeek

Analyze Zeek network logs to detect lateral movement including SMB share access, DCE/RPC service execution, and NTLM account spray.

Tags

Updated: 2026-09-19
zeeklateral-movementsmbdce-rpcntlm-spraynetwork-forensics

Capabilities

Verify Zeek log collectionParse conn.log for lateral connectionsAnalyze SMB admin share accessDetect DCE/RPC remote service operations

Typical Inputs

Zeek log filesZeek log directory pathAgent analysis script agent.py

Typical Outputs

notice.log alertsAnalysis execution results

What this skill does

  • Verify Zeek log collection
  • Parse conn.log for lateral connections
  • Analyze SMB admin share access
  • Detect DCE/RPC remote service operations
  • Detect NTLM account spray activity
  • Run automated analysis script

Inputs

  • Zeek log files
  • Zeek log directory path
  • Agent analysis script agent.py

Outputs

  • notice.log alerts
  • Analysis execution results

Requirements

  • Zeek 6.0+
  • Zeek SMB analyzer enabled
  • Zeek DCE/RPC analyzer enabled
  • Zeek Kerberos analyzer enabled
  • Python 3.8+
  • Access to Zeek log directory

Source

  • Spec: SKILL.md

ClawIndex

OpenClaw Skills & Use Case Index

ClawIndex is an ecosystem-driven index of OpenClaw skills and real-world use cases.

Index

Skills·
Cases

Meta

About·
Disclaimer·
Email·
GitHub
© 2026 ClawIndex All Rights Reserved.