# Standards & References

## MITRE ATT&CK — Lateral Movement (TA0008)
- **T1021.001** Remote Desktop Protocol
- **T1021.002** SMB/Windows Admin Shares
- **T1021.003** DCOM
- **T1021.006** Windows Remote Management
- **T1550.002** Pass the Hash
- **T1570** Lateral Tool Transfer
- **T1210** Exploitation of Remote Services

## Zeek Documentation
- [Zeek SMB Analyzer](https://docs.zeek.org/en/current/scripts/base/protocols/smb/)
- [Zeek DCE-RPC Analyzer](https://docs.zeek.org/en/current/scripts/base/protocols/dce-rpc/)
- [Zeek NTLM Analyzer](https://docs.zeek.org/en/current/scripts/base/protocols/ntlm/)
- [zeek-cut Reference](https://docs.zeek.org/en/current/auxil/zeek-cut/)

## Detection References
- SANS: Detecting Lateral Movement with Zeek
- Red Canary Threat Detection Report — Lateral Movement chapter