{"slug":"detecting-lateral-movement-with-zeek","source_name":"detecting-lateral-movement-with-zeek","name":"Detecting Lateral Movement With Zeek","description":"Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.","version":1,"lift":{"pass_rate_delta_pts":43.48,"pass_rate_pct":52.2,"total_cases":23,"passed_cases":12,"tokens_delta_pct":73.3,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-31T13:16:42.564770+00:00"},"skill_score":0.5217,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":43.48,"with_pass_pct":52.2,"without_pass_pct":8.7,"tokens_delta_pct":73.3,"turns_delta_pct":0,"total_cases":23,"cases_aggregated":22,"verdict":"mixed","never_hurt":false,"completed_at":"2026-07-31T13:16:42.564770+00:00","run_id":"e7df8e2e-3358-4526-9eaf-a5f062f21f9c","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"c0a8eb092c03208f144d16638d571e318d70a16b267ff8e7398906f48c71aace","raw_url":"https://app.decimal.ai/s/detecting-lateral-movement-with-zeek/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/detecting-lateral-movement-with-zeek"}