{"slug":"detecting-wmi-persistence","source_name":"detecting-wmi-persistence","name":"Detecting Wmi Persistence","description":"Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.","version":1,"lift":{"pass_rate_delta_pts":31.82,"pass_rate_pct":31.8,"total_cases":22,"passed_cases":7,"tokens_delta_pct":22.3,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T02:20:38.955356+00:00"},"skill_score":0.3182,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":31.82,"with_pass_pct":31.8,"without_pass_pct":0,"tokens_delta_pct":22.3,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":21,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T02:20:38.955356+00:00","run_id":"ee7322d5-57ce-49d8-953e-50e64a6e456b","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"d56b291a79fb368cf741046e464666af2469ad045464996b87efd8682a511a55","raw_url":"https://app.decimal.ai/s/detecting-wmi-persistence/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/detecting-wmi-persistence"}