Detecting Lateral Movement With Zeek

Mahipal

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-zeek

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-zeek -a claude-code -g

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-lateral-movement-with-zeek -a codex -g

gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-lateral-movement-with-zeek

gh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-lateral-movement-with-zeek

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-with-zeek ~/.claude/skills/detecting-lateral-movement-with-zeek   # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-with-zeek ~/.agents/skills/detecting-lateral-movement-with-zeek   # Codex, Cursor, Gemini CLI, Copilot, OpenCode

Install

Related