detecting-lateral-movement-with-zeek
mukul975/Anthropic-Cybersecurity-Skills
Use Zeek traffic logs (conn, smb_mapping, smb_files, dce_rpc, kerberos, ntlm) to spot SMB admin share access, DCE/RPC service control patterns, NTLM spray activity, and anomalous internal transfers for post-compromise hunting and alerting.