{"slug":"hunting-for-shadow-copy-deletion","source_name":"hunting-for-shadow-copy-deletion","name":"Hunting For Shadow Copy Deletion","description":"Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.","version":1,"lift":{"pass_rate_delta_pts":29.17,"pass_rate_pct":33.3,"total_cases":24,"passed_cases":8,"tokens_delta_pct":21.4,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T08:27:06.666187+00:00"},"skill_score":0.3333,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":29.17,"with_pass_pct":33.3,"without_pass_pct":4.2,"tokens_delta_pct":21.4,"turns_delta_pct":0,"total_cases":24,"cases_aggregated":24,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T08:27:06.666187+00:00","run_id":"0503d099-7efa-46e8-ab8f-d16f3d431181","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":1,"manifest_hash":"f81e819d1734b94cb5076163cfd6dd7a8f7c0fff61824604ba0028ca23c0acbf","raw_url":"https://app.decimal.ai/s/hunting-for-shadow-copy-deletion/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/hunting-for-shadow-copy-deletion"}