detecting-lateral-movement-with-zeek

name	detecting-lateral-movement-with-zeek
description	Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
domain	cybersecurity
subdomain	network-security
tags	["zeek","lateral-movement","smb","dce-rpc","ntlm-spray","network-forensics"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Detecting Lateral Movement with Zeek

Analyze Zeek network logs to identify lateral movement techniques including SMB admin share access, DCE/RPC remote service creation, NTLM account spray, Kerberos ticket anomalies, and large internal data transfers indicative of staging or exfiltration between hosts.

When to Use

• Hunting for lateral movement after an initial compromise indicator is found on one endpoint
• Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network
• Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)
• Detecting remote service execution via DCE/RPC (PsExec, schtasks, WMI lateral patterns)
• Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment
• Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source

Do not use as a standalone detection mechanism. Zeek sees network traffic only; combine with endpoint telemetry (Sysmon, EDR) for full visibility. Encrypted SMB3 traffic may limit Zeek's visibility into file-level details.

Detection Gaps & Validation

• SMB3 encryption blinds file-level logs: with SMB3 encryption negotiated, smb_files.log/smb_mapping.log lose path and filename detail, so admin-share write rules silently miss. Fall back to conn.log 445 volume/asymmetry between internal hosts and flag the encrypted SMB sessions themselves rather than concluding "no lateral movement."
• WMI/DCOM and WinRM evade the svcctl signature: PsExec hits svcctl, but WMIExec uses IWbemServices over 135+ephemeral DCOM and WinRM rides 5985/5986 (often as HTTP/SOAP). Grep dce_rpc.log for IWbemServices/IRemUnknown2 and watch WinRM ports, not just svcctl/atsvc.
• Kerberos (Pass-the-Ticket/overpass) leaves no NTLM trail: the NTLM-spray script won't fire when attackers use Kerberos. Add kerberos.log checks for anomalous TGS requests, encryption downgrade (etype RC4/0x17), and one account requesting tickets for many SPNs/hosts.
• Spray threshold is evasion-prone: spray_threshold=3 over 5min misses slow spraying across hours. Widen the &create_expire window and track distinct id.resp_h per username over a longer epoch; tune up to cut FPs from vuln scanners/SCCM.