detecting-lateral-movement-with-zeek - Detect lateral movement in network traffic using Zeek logs.
Parses Zeek logs to identify SMB file transfers, NTLM account spray, remote service execution, and anomalous internal connections.
Tags
Updated: 2026-09-19Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Parse Zeek network logs
- Detect SMB admin share access
- Identify DCE RPC service operations
- Detect NTLM account spray activity
- Run automated analysis script
Inputs
- Zeek log directory
- Zeek log files
Outputs
- Zeek notice.log alerts
- Automated analysis detection results
Requirements
- Zeek 6.0+
- Python 3.8+
- Access to Zeek log directory
- Enabled SMB DCE-RPC Kerberos analyzers