{"slug":"detecting-living-off-the-land-attacks","source_name":"detecting-living-off-the-land-attacks","name":"Detecting Living Off The Land Attacks","description":"Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.","version":1,"lift":{"pass_rate_delta_pts":27.27,"pass_rate_pct":45.5,"total_cases":22,"passed_cases":10,"tokens_delta_pct":178.1,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T02:07:20.979969+00:00"},"skill_score":0.4545,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":27.27,"with_pass_pct":45.5,"without_pass_pct":18.2,"tokens_delta_pct":178.1,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T02:07:20.979969+00:00","run_id":"1c537fa0-592e-48ad-8512-e522491b47fc","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"92dec395d493fdb6a1cab64572946fec64582f81c1cf534728163a472fc26653","raw_url":"https://app.decimal.ai/s/detecting-living-off-the-land-attacks/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/detecting-living-off-the-land-attacks"}