Anthropic-Cybersecurity-Skills/skills/detecting-lateral-movement-with-zeek/references/standards.md

Standards & References

MITRE ATT&CK — Lateral Movement (TA0008)

• T1021.001 Remote Desktop Protocol
• T1021.002 SMB/Windows Admin Shares
• T1021.003 DCOM
• T1021.006 Windows Remote Management
• T1550.002 Pass the Hash
• T1570 Lateral Tool Transfer
• T1210 Exploitation of Remote Services

Zeek Documentation

• Zeek SMB Analyzer
• Zeek DCE-RPC Analyzer
• Zeek NTLM Analyzer
• zeek-cut Reference

Detection References

• SANS: Detecting Lateral Movement with Zeek
• Red Canary Threat Detection Report — Lateral Movement chapter