{"slug":"hunting-for-defense-evasion-via-timestomping","source_name":"hunting-for-defense-evasion-via-timestomping","name":"Hunting For Defense Evasion Via Timestomping","description":"Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION vs $FILE_NAME timestamps in the MFT. Uses analyzeMFT and Python to identify files with anomalous temporal patterns indicating anti-forensic timestomping activity.","version":1,"lift":{"pass_rate_delta_pts":18.18,"pass_rate_pct":27.3,"total_cases":22,"passed_cases":6,"tokens_delta_pct":140.9,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T08:34:54.720329+00:00"},"skill_score":0.2727,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":18.18,"with_pass_pct":27.3,"without_pass_pct":9.1,"tokens_delta_pct":140.9,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":21,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T08:34:54.720329+00:00","run_id":"1d85ba74-3896-4691-a77b-b8b409f85f0a","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"d8532967d7004910dc439604e1816e4e0c888f904e9364a939153f8a49b9c792","raw_url":"https://app.decimal.ai/s/hunting-for-defense-evasion-via-timestomping/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/hunting-for-defense-evasion-via-timestomping"}