Windows active directory intrusion benchmarks expose detection gaps

At a glance

What this is: This benchmark packages a real multi-host Windows Active Directory intrusion into 40 scored tasks, and its key finding is that open-ended incident reporting is consistently harder than targeted investigation and detection engineering.

Why it matters: For IAM and security teams, it shows how quickly credential abuse and lateral movement can outrun detection narratives, which matters whenever human, service, or domain credentials are the bridge between initial access and full compromise.

By the numbers:

• The benchmark uses 3.9M+ real events across 40 log tables, covering five hosts in a live Windows intrusion dataset.
• GPT-5.6 Sol reached 79.2% accuracy, ahead of Claude Opus 4.7 at 75.5% and Claude Opus 4.8 at 74.2%.
• Opus 4.8 finished tasks in about 2.3 minutes using roughly 13 tool calls on average, the fewest of any frontier model.

👉 Read Cotool's BlueBench-Intrusion-002 analysis of Active Directory intrusion detection

Context

Windows Active Directory remains a high-value target because a single password spray, remote tool install, or stolen domain credential can turn one foothold into broad administrative reach. In this benchmark, the attack path moved from RDP password spraying to hidden admin creation, credential dumping, lateral movement, and domain controller replication, which is a familiar compromise pattern in enterprise identity environments.

The primary lesson is not about one model’s score. It is about how brittle enterprise detection becomes when credential abuse is mixed with living-off-the-land movement and multi-host persistence. That is especially relevant to IAM, PAM, and NHI governance because the same control failures that expose human admin paths often expose service accounts and other non-human identities as well.

Key questions

Q: What breaks when password spraying is not detected early in Windows environments?

A: A single successful spray can convert many weak attempts into one valid session, and that session often becomes the foothold for privilege escalation, remote tooling, and lateral movement. The practical failure is not just authentication noise. It is the loss of time, because defenders no longer see one attack, they see a domain intrusion already in progress.

Q: Why do hidden admin accounts increase compromise severity in Active Directory?

A: Hidden admin accounts create standing privilege that survives the initial intrusion and gives attackers a reusable control channel. They are dangerous because they separate the compromise from the investigator’s first alert, which means the attacker can keep moving even after the original login is blocked. Remove or monitor them with the same rigor as domain admin groups.

Q: How do security teams know whether lateral movement exposure is actually improving?

A: Teams should measure how many systems remain reachable from a single internal foothold, how many critical hosts accept broad RDP or SSH, and how much authentication still depends on legacy protocols. If those numbers are not falling, the environment is still highly reusable for attackers.

Q: Who is accountable when domain controller credential replication is abused?

A: Accountability should sit jointly with identity operations, platform security, and incident response, because replication abuse sits at the intersection of directory governance and detection. The right control owners are the teams that manage directory permissions, monitor replication events, and can revoke exposed administrative paths before the breach broadens.

Technical breakdown

RDP password spraying as the initial access pattern

RDP spraying works by trying a small number of common passwords across many accounts until one succeeds. In Windows environments, this often blends into normal authentication noise unless the environment has good lockout policy, geo-velocity analysis, and source-based correlation. The benchmark’s attack path begins here because an attacker needs only one weak credential to open the door, after which the session can be converted into a more durable foothold. Practical implication: watch for distributed authentication attempts that stay just below threshold and tie them to source IP reputation, account risk, and session patterns.

Practical implication: detect distributed password spray activity before a single successful login becomes a durable foothold.

Credential dumping and hidden admin creation

Once inside, attackers often dump credentials with tools such as Mimikatz and then create or repurpose privileged accounts to preserve access. Credential dumping targets memory or cached secrets, while hidden admin creation turns a short-lived breach into standing privilege. The two together are especially dangerous because they separate the moment of compromise from the moment of full control. In identity terms, this is where weak privilege hygiene becomes an escalation engine, and where service accounts or admin accounts without strong monitoring become exploitable assets. Practical implication: enforce detection on both in-memory credential access and privileged account lifecycle changes.

Practical implication: correlate memory-based secret access with privileged account creation and review standing administrative paths.

WMI lateral movement and domain controller replication

Windows Management Instrumentation lets attackers execute commands remotely without dropping a new binary on every host, which makes lateral movement harder to spot. In this benchmark, WMI was used across five hosts before the domain controller was reached for credential replication, meaning the attacker did not need to break each system individually. Domain replication abuse is particularly severe because it can expose the crown jewels of the identity environment at once. Practical implication: segment administrative channels, restrict remote execution paths, and monitor replication-related events as high-severity identity abuse signals.

Practical implication: restrict remote execution paths and alert on domain replication abuse as a high-severity identity event.

Threat narrative

Attacker objective: The attacker aimed to convert one weak login into durable domain-level control by harvesting credentials, moving laterally, and reaching the domain controller.

1. Entry began with RDP password spraying across the Windows Active Directory environment until one account accepted a weak or reused credential.
2. Escalation followed through silent remote-access tooling, hidden admin account creation, and credential dumping with Mimikatz to gain standing control.
3. Impact came from WMI-based lateral movement across five hosts and domain controller credential replication, which exposed broader identity control and likely enabled full domain compromise.

NHI Mgmt Group analysis

Detection engineering is now an identity governance problem as much as a SOC problem. This benchmark shows that the hardest part is not spotting a single login anomaly, but understanding how credential abuse, account creation, and lateral movement chain together across hosts. That is why IAM, PAM, and SIEM teams need shared telemetry and shared escalation paths. The practitioner conclusion is that identity events must be treated as attack sequences, not isolated alerts.

Standing privilege remains the core failure mode in Windows compromise. Once the attacker created or reused privileged access, the environment effectively gave them time to turn one intrusion into repeated control. This is the same structural weakness that appears in NHI estates when service accounts, tokens, or domain credentials are left in place without tight lifecycle control. The practitioner conclusion is to reduce the lifetime of every privileged credential and remove unused admin paths before an attacker finds them.

“Detection-response latency” is the right named concept for this class of intrusion. The attacker’s path depended on enough time between initial access, credential access, and domain replication for each step to succeed. That latency gap is where many environments fail, because ownership is split across endpoint, identity, and logging teams. The practitioner conclusion is to measure time-to-correlate across those domains, not just time-to-alert.

Machine and human identities fail in the same way when lifecycle controls are weak. Although this case is about Windows intrusion rather than NHI sprawl, the governance lesson carries over directly: any identity that can authenticate, elevate, and persist is a security boundary. Service accounts, admin users, and remote-access identities all need explicit ownership, review, and revocation paths. The practitioner conclusion is to govern identity lifecycle as an attack surface, not an administrative chore.

Open-ended incident reporting exposes programme maturity more clearly than point detection does. The benchmark’s biggest gap was synthesis, which mirrors how many organisations struggle to turn fragmented telemetry into a defensible incident story. That matters for GRC, compliance, and resilience reporting because the board does not consume raw logs. The practitioner conclusion is to build reporting templates and evidence chains before the next incident forces the issue.

What this signals

Detection-response latency is becoming a board-level metric for identity-led attacks, because the gap between first credential misuse and domain-wide impact is where the real damage accumulates. Teams that cannot correlate authentication, privilege, and host telemetry fast enough will keep losing the window that matters most.

This benchmark also reinforces that identity telemetry must extend beyond human admins to service accounts and remote-access identities. When those identities are unmanaged, the same pattern that drives Active Directory compromise also drives NHI exposure, which is why lifecycle governance and logging need to be designed together.

The practical signal for programmes is simple: if an intrusion can move from one login failure to domain controller replication without triggering a joined identity narrative, your control stack is still operating in silos. That is where NIST Cybersecurity Framework 2.0 style cross-functional governance becomes operational rather than theoretical.

For practitioners

• Harden RDP exposure and spray detection Limit RDP exposure, enforce strong lockout and risk-based authentication, and alert on distributed login attempts that span many accounts and a short time window.
• Correlate memory credential access with privilege changes Treat Mimikatz-like credential dumping and hidden admin creation as a single escalation chain, then route both to the same investigation queue for immediate containment.
• Restrict WMI and other remote execution paths Constrain administrative remoting to approved hosts, log WMI execution lineage, and baseline the wmiprvse.exe to cmd.exe to powershell.exe pattern against normal IT automation.
• Monitor domain replication as an identity event Flag unusual directory replication activity from non-standard hosts and pair it with privileged account telemetry, because replication abuse is a direct path to domain-wide secret exposure.

Key takeaways

• This benchmark shows that a real intrusion becomes hard to stop once credential abuse, privilege creation, and lateral movement are stitched together.
• The operational weak point is not one alert type, but the inability to synthesize identity, host, and network evidence into a single incident story.
• Teams should treat domain credentials, admin paths, and remote execution channels as one governed attack surface, not three separate problems.

Key terms

• Password Spraying: A guessing technique that uses a small set of common passwords against many accounts to avoid lockouts and detection. It is effective when organisations do not reject common passwords, do not monitor patterns across identities, or allow too much standing access.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Domain Controller Replication Abuse: Domain controller replication abuse is the misuse of directory replication rights to extract or synchronize sensitive credential material from a domain controller. It is especially dangerous because it can expose high-value identity secrets at the core of the directory service, turning a local compromise into domain-wide risk.

What's in the full report

Cotool's full research covers the operational detail this post intentionally leaves for the source:

• Task-by-task benchmark breakdown showing where detection engineering, malware analysis, and incident reporting diverged.
• Model-by-model latency, cost, and tool-call data for teams comparing investigation workflows.
• The full attack-path reconstruction, including the exact sequence from spray to domain credential replication.
• Benchmark methodology notes on how every detection rule was re-executed against the live dataset.

👉 Cotool's full benchmark report includes the attack path, scoring method, and model-by-model results.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, and machine identity security in practical terms. It helps security teams connect identity lifecycle controls to the broader security operations that depend on them.