| name | detecting-lateral-movement-with-zeek |
| description | Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
|
| domain | cybersecurity |
| subdomain | network-security |
| tags | ["zeek","lateral-movement","smb","dce-rpc","ntlm-spray","network-forensics"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"] |
| mitre_attack | ["T1046","T1040","T1557","T1071","T1021"] |
Detecting Lateral Movement with Zeek
Analyze Zeek network logs to identify lateral movement techniques including
SMB admin share access, DCE/RPC remote service creation, NTLM account spray,
Kerberos ticket anomalies, and large internal data transfers indicative
of staging or exfiltration between hosts.
When to Use
- Hunting for lateral movement after an initial compromise indicator is found on one endpoint
- Investigating suspected NTLM account spray or Pass-the-Ticket attacks across the internal network
- Monitoring SMB traffic for unauthorized file transfers to admin shares (C$, ADMIN$, IPC$)
- Detecting remote service execution via DCE/RPC (PsExec, schtasks, WMI lateral patterns)
- Building alerting rules for internal network anomalies in a Zeek-based NSMP deployment
- Performing post-incident timeline reconstruction using Zeek logs as a network-level evidence source
Do not use as a standalone detection mechanism. Zeek sees network traffic only; combine with endpoint telemetry (Sysmon, EDR) for full visibility. Encrypted SMB3 traffic may limit Zeek's visibility into file-level details.
Prerequisites
- Zeek 6.0+ deployed on a network tap or SPAN port monitoring internal VLAN traffic
- Zeek SMB analyzer enabled (loaded by default:
@load base/protocols/smb)
- Zeek DCE/RPC analyzer enabled (
@load base/protocols/dce-rpc)
- Zeek Kerberos analyzer enabled (
@load base/protocols/krb)
- Python 3.8+ (standard library only)
- Access to Zeek log directory (default:
/opt/zeek/logs/current/)
- Familiarity with Zeek TSV log format (fields separated by
\t, header lines prefixed with #)
Workflow
Step 1: Verify Zeek Log Collection
Confirm that Zeek is producing the required log files for lateral movement detection:
ls -la /opt/zeek/logs/current/conn.log
ls -la /opt/zeek/logs/current/smb_mapping.log
ls -la /opt/zeek/logs/current/smb_files.log
ls -la /opt/zeek/logs/current/dce_rpc.log
ls -la /opt/zeek/logs/current/kerberos.log
ls -la /opt/zeek/logs/current/ntlm.log
zeek-cut id.orig_h id.resp_h id.resp_p proto service < /opt/zeek/logs/current/conn.log | -20
