skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-lateral-movement-with-zeek

Detect lateral movement by analyzing Zeek conn, SMB, DCE/RPC, NTLM, and Kerberos logs.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#network security#threat hunting#lateral movement#SMB#zeek#NTLM
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-lateral-movement-with-zeek
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-lateral-movement-with-zeek
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/network-security/detecting-lateral-movement-with-zeek
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-lateral-movement-with-zeek

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams hunting for attacker lateral movement inside a network need a repeatable way to turn raw Zeek network logs into concrete evidence of SMB admin share abuse, remote service execution, and credential spraying, instead of manually grepping gigabytes of TSV logs.

Core Features & Use Cases

  • Zeek Log Analysis Workflow: Step-by-step parsing of conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log using zeek-cut and awk to surface internal-host connections on ports 445, 135, and 5985/5986.
  • Detection-as-Code Scripts: Ready-to-deploy Zeek scripts that raise notice.log alerts for admin share access (C$, ADMIN$, IPC$) and NTLM account spray when one account touches more hosts than a configurable threshold.
  • Gap & Evasion Guidance: Documents blind spots such as SMB3 encryption hiding file-level detail, WMI/WinRM evading svcctl signatures, and Kerberos-based attacks bypassing NTLM detection, with compensating checks.
  • Use Case: After an EDR alert on one endpoint, an analyst runs this workflow against the Zeek logs for the internal VLAN to confirm whether the attacker used PsExec-style SMB writes and svcctl service creation to reach other hosts, then validates with Sysmon Event ID 1.

Quick Start

Analyze the Zeek logs in /opt/zeek/logs/current/ for signs of lateral movement such as admin share access, DCE/RPC service creation, and NTLM account spray.

Frequently Asked Questions about detecting-lateral-movement-with-zeek

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect lateral movement with Zeek logs?▼

Parse conn.log for internal connections on ports 445, 135, and 5985/5986, then check smb_mapping.log and smb_files.log for admin share access and file writes. Correlate with dce_rpc.log svcctl operations and ntlm.log authentication patterns to confirm lateral movement.

How to detect PsExec activity in Zeek network logs?▼

PsExec leaves a two-stage trace: an SMB FILE_WRITE of the service binary to an admin share in smb_files.log, followed by a svcctl CreateService operation in dce_rpc.log. Deploying the provided admin share notice script generates alerts on C$, ADMIN$, or IPC$ access.

What is NTLM account spray detection in Zeek?▼

NTLM account spray detection tracks how many distinct hosts a single account authenticates to within a time window using ntlm.log. The provided Zeek script raises a notice when one username exceeds a threshold of three destination hosts within five minutes.

Does Zeek detect lateral movement over encrypted SMB3?▼

SMB3 encryption blinds smb_files.log and smb_mapping.log to paths and filenames, so file-level rules silently miss. Fall back to conn.log volume and asymmetry analysis on port 445 between internal hosts and flag the encrypted SMB sessions themselves.

Why does Zeek miss WMI or WinRM lateral movement?▼

The svcctl signature only catches PsExec-style tools; WMIExec uses IWbemServices over port 135 plus ephemeral DCOM ports, and WinRM rides ports 5985/5986 as HTTP/SOAP. Grep dce_rpc.log for IWbemServices and monitor WinRM ports separately.

What are the limitations of Zeek-only lateral movement detection?▼

Zeek sees network traffic only and cannot observe endpoint behavior, so it should be combined with Sysmon or EDR telemetry for full visibility. Slow sprays below the threshold window and Kerberos-based Pass-the-Ticket attacks also evade the default NTLM rules.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

crackmapexec

Automate Active Directory credential spraying, enumeration, and remote command execution over SMB and WinRM.

Community
Advanced
Yamato-SecurityYamato-Security
26

investigate_jp

Analyze Hayabusa CSV logs to generate Japanese intrusion timelines and incident reports.

Official
Advanced
balsm-healthbalsm-health
2

triaging-security-incident

Automate security incident triage using NIST SP 800-61r3 and SANS PICERL frameworks.

Official
Advanced
balsm-healthbalsm-health
2

hunting-for-unusual-network-connections

Analyze EDR, SIEM, and Sysmon logs for unusual network connections.

Official
Advanced