Zeek’s `conn.log` is gold for lateral movement hunting—look for odd service pairs (e.g., SMB from a web server) or beaconing intervals. For IDS evasion, remember: fragmented TCP segments often bypass

Zeek’s `conn.log` is gold for lateral movement hunting—look for odd service pairs (e.g., SMB from a web server) or beaconing intervals. For IDS evasion, remember: fragmented TCP segments often bypass signature checks but still reassemble on the victim. Test your own detections by replaying pcaps with `tcpreplay`—if your sensor misses it, so will theirs. Practice these tradecraft basics in a safe s