domains / families / security / detecting-lateral-movement-with-zeek

detecting-lateral-movement-with-zeek

separate

'Detect lateral movement in network traffic using Zeek (formerly Bro)

When to use

• Hunting for lateral movement after an initial compromise indicator is found on one endpoint
• Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network
• Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)
• Detecting remote service execution via DCE/RPC (PsExec, schtasks, WMI lateral patterns)
• Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment
• Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source

When not to use

• Standalone detection mechanism
• Full visibility without endpoint telemetry
• File-level details in encrypted SMB3 traffic

Skill page

Source