detecting-lateral-movement-with-zeek - Detecting Lateral Movement with Zeek
Detect lateral movement in network traffic by analyzing Zeek logs to identify SMB transfers, NTLM spray, remote service execution, and connection anomalies.
Tags
Updated: 2026-09-19Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Verify Zeek log collection
- Parse conn.log for lateral patterns
- Analyze SMB admin share access
- Detect DCE/RPC remote service operations
- Detect NTLM account spray
- Run automated analysis agent
Inputs
- Zeek log directory
- Zeek log files
- Internal network traffic
Outputs
- Notice log alerts
- Lateral movement detection results
Requirements
- Zeek 6.0+
- Zeek SMB analyzer
- Zeek DCE/RPC analyzer
- Zeek Kerberos analyzer
- Python 3.8+
- Access to Zeek log directory