detecting-lateral-movement-with-zeek - Detect Lateral Movement with Zeek
Parses Zeek logs to detect SMB admin share access, DCE/RPC remote service execution, NTLM account spray, and anomalous internal connections.
Tags
Updated: 2026-09-19Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Parse Zeek network logs
- Analyze SMB admin share access
- Detect DCE RPC service operations
- Identify NTLM account spray activity
- Run automated analysis agent
Inputs
- Zeek log directory
- Zeek network logs
Outputs
- Zeek notice.log alerts
- Automated analysis detection results
Requirements
- Zeek 6.0+
- Python 3.8+
- Access to Zeek log directory
- Enabled Zeek SMB analyzer
- Enabled Zeek DCE RPC analyzer
- Enabled Zeek Kerberos analyzer