{"slug":"performing-active-directory-compromise-investigation","source_name":"performing-active-directory-compromise-investigation","name":"Performing Active Directory Compromise Investigation","description":"Investigate Active Directory compromise by analyzing authentication logs, replication metadata, Group Policy changes, and Kerberos ticket anomalies to identify attacker persistence and lateral movement paths.","version":1,"lift":{"pass_rate_delta_pts":8.7,"pass_rate_pct":8.7,"total_cases":23,"passed_cases":2,"tokens_delta_pct":87.2,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T10:14:39.153656+00:00"},"skill_score":0.087,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":8.7,"with_pass_pct":8.7,"without_pass_pct":0,"tokens_delta_pct":87.2,"turns_delta_pct":0,"total_cases":23,"cases_aggregated":23,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T10:14:39.153656+00:00","run_id":"12636d89-276f-4c94-ad71-302e013f119c","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":"safe","content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"2e8fdb6d69578ec51c2339277045d364f6cec812e3b481d6c70acabcf5a19fc9","raw_url":"https://app.decimal.ai/s/performing-active-directory-compromise-investigation/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/performing-active-directory-compromise-investigation"}