Windows active directory intrusion benchmarks expose detection gaps

At a glance

What this is: Cotool benchmarks model performance against a real Windows Active Directory intrusion and finds that chained adversary behaviour still exposes major weaknesses in detection engineering and incident reporting.

Why it matters: This matters because defenders need detections that survive multi-step intrusion paths, not just isolated alerts, and identity teams must understand how standing privileges and account abuse enable lateral movement.

By the numbers:

• The dataset contains 3.9M+ real events across 40 log tables.
• BlueBench-Intrusion-002 includes 40 scored tasks per model.
• The benchmark spans 22 models in the Jul 2026 run.

Context

A Windows Active Directory intrusion benchmark is only useful if it reflects how real attackers move. Here, the core problem is not a single alert or a lone credential leak, but the combination of password spraying, hidden account creation, credential dumping, lateral movement, and domain controller compromise across several hosts. For identity and security teams, that sequence tests whether controls can correlate privilege abuse across authentication, endpoint, and Windows telemetry.

The broader governance gap is that many detection programs still optimise for isolated signals instead of attack paths. In environments built around Active Directory, service accounts, admin accounts, and remote execution mechanisms can create the conditions for quiet escalation long before a high-severity event appears. That makes this benchmark relevant to IAM, PAM, and NHI governance because it shows how identity misuse becomes an operational detection problem, not just an access-control issue.

Key questions

Q: What breaks when attackers chain password spraying, admin creation, and lateral movement in Active Directory?

A: Defenders lose the ability to treat alerts as independent events. Once an attacker turns one weak authentication path into hidden privilege, credential dumping, and remote execution, the environment needs correlation across identity, endpoint, and directory telemetry or the intrusion will look like several unrelated findings instead of one campaign.

Q: Why do Active Directory attacks that abuse standing privilege increase detection and response risk?

A: Because the attacker can move from access to authority without creating a new trust decision at every step. Standing privilege lets hidden admin activity, remote execution, and domain controller access appear normal long enough to delay triage, which is why least-privilege governance and account lifecycle controls matter so much.

Q: How do security teams know if detection engineering is actually catching multi-host intrusions?

A: By re-executing the rule against known attack data and checking whether it fires on the full sequence, not just one command line or one process. If a rule cannot survive correlation, noise filtering, and live event ordering, it is not yet a reliable detection.

Q: What should incident responders capture first when a Windows domain compromise is suspected?

A: Capture the account timeline, affected hosts, and execution sequence before the environment changes further. That evidence set determines whether responders can reconstruct spray, privilege creation, credential theft, lateral movement, and domain controller access as one incident rather than a collection of disconnected alerts.

Technical breakdown

How a Windows intrusion becomes a multi-host identity problem

Active Directory intrusions rarely stay at the authentication layer. A password spray can establish the first foothold, but the real risk starts when the attacker turns that foothold into usable authority by creating or abusing accounts, extracting credential material, and moving laterally with native Windows mechanisms. In this benchmark, the sequence includes RDP access, a remote-access tool, Mimikatz credential dumping, WMI execution, and domain controller replication. That mix matters because each stage changes the telemetry surface and the trust boundary. Identity controls, endpoint detections, and network analytics all have to agree that the same actor is progressing through the environment.

Practical implication: Tie authentication, endpoint, and directory signals together so identity abuse is detected as a chain, not as separate events.

Why report synthesis fails when the evidence spans many hosts

Open-ended incident reporting is harder than answering specific questions because the model has to select, order, and explain the relevant facts without prompt scaffolding. In a multi-host intrusion, that means distinguishing signal from noise, preserving chronology, and connecting discrete artifacts into a coherent attack story. The benchmark shows that even strong models can answer targeted questions about the intrusion while omitting material facts when asked to write a full report. That is a governance problem as much as an analytics problem, because incident response quality depends on whether teams can reconstruct what happened across accounts, endpoints, and movement paths.

Practical implication: Treat incident reporting as an evidence-assembly workflow that requires structured data and explicit chronology, not just narrative generation.

Detection engineering must validate rules against live adversary behavior

Detection rules only matter if they fire on the attack path that actually occurred. The benchmark re-executes every rule against the live dataset, which exposes a common weakness in security operations: plausible detections that do not survive real event sequences. Single-event matches are easy; correlation rules that join service-install activity to later execution or network telemetry are far harder. That distinction is important for Active Directory environments because attacker tradecraft often hides inside legitimate Windows services and remote administration patterns. If the rule cannot reproduce on the dataset, it cannot be relied on operationally.

Practical implication: Test detections against known attack paths and prioritize correlation logic that proves it can separate attacker behavior from administrative noise.

Threat narrative

Attacker objective: The attacker’s objective was to gain durable domain-level control, extract high-value credentials, and demonstrate end-to-end movement across the Active Directory environment.

1. Entry occurred through an RDP password spray that gave the attacker initial access to the Windows Active Directory environment.
2. Escalation followed through hidden admin account creation, credential dumping with Mimikatz, and use of a renamed tunneling tool to maintain command and control.
3. Lateral movement used WMI across five hosts before the attacker replicated credentials from the domain controller.
4. Impact was theft of domain credentials and multi-host compromise inside the lab environment.

Breaches seen in the wild

• Cisco Active Directory credentials leak 2025: Kraken leaked Cisco Active Directory hashes, including service and krbtgt accounts; Cisco says they came from its 2022 breach, not a new one.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Active Directory intrusions are identity incidents before they are malware incidents. The benchmark makes that plain by chaining password spraying, hidden admin creation, credential dumping, and domain controller replication into one operational path. That is why IAM and PAM teams should read the results as evidence that directory governance and detection engineering now share the same failure surface. The practical conclusion is that access patterns must be monitored as attack progression, not as isolated account events.

Report quality is now a control surface. If an incident can be investigated but not reconstructed, the organisation has a governance gap in evidence handling and triage quality. This benchmark shows that open-ended reporting remains brittle even when guided questions are answered well, which means boards and security leaders should be careful about over-trusting narrative outputs. The practical conclusion is that incident workflows need structured evidence capture before they need better prose generation.

Detection precision, not tool volume, separates useful security automation from noisy automation. The benchmark’s strongest runs were the ones that filtered and joined the right telemetry instead of paging through everything. That is a direct lesson for identity security programmes: privilege abuse and lateral movement become visible when teams can express them as correlated control failures. The practical conclusion is to invest in detections that validate against live paths and reduce false confidence in isolated alerts.

Windows service masquerading creates a detection blind spot that identity controls alone cannot close. The attacker’s renamed tunnelling tool shows how easily malicious activity can hide behind normal administrative patterns. This is where endpoint, network, and identity telemetry have to be governed together, because no single layer sees the whole sequence. The practical conclusion is to treat masqueraded remote access as a cross-domain detection problem that requires both provenance and privilege context.

What this signals

Active Directory compromise paths now have to be governed as identity workflows, not just endpoint events. When an intrusion sequence moves from sprayed credentials to hidden administration and then to domain controller access, the security team is dealing with a control failure that spans authentication, privilege, and lateral movement. The practical signal is that IAM and PAM telemetry need to sit inside the same detection logic as Windows and EDR data.

Report synthesis is becoming a measurable operational capability. If a team cannot turn multi-host evidence into a complete incident narrative, it will struggle to brief executives, preserve decision records, or justify containment choices. The practical signal is to standardise evidence capture and chronology before the incident so the report is built from facts, not memory.

Detection engineering must move beyond single-event thinking. Multi-step Active Directory intrusions expose rules that fire on one process but miss the surrounding sequence. The practical signal is to validate correlations across account creation, remote execution, and credential access, then retire detections that cannot prove themselves against replayed attack paths.

For practitioners

• Harden RDP entry paths Restrict RDP exposure, require step-up controls for admin access, and monitor password-spray patterns against privileged and service accounts.
• Correlate directory and endpoint telemetry Build detections that join account creation, credential-dumping, WMI execution, and network egress so the full intrusion path is visible.
• Validate detection rules against replayed attack paths Re-run correlation logic on known multi-host intrusion traces and reject rules that only work as single-event string matches.
• Treat hidden admin creation as a high-severity identity event Alert on new privileged principals, especially when they appear outside normal change windows or after failed authentication bursts.
• Separate incident narrative from evidence collection Require investigators to capture host, account, and sequence evidence in structured form before drafting a human-readable report.

Key takeaways

• This benchmark shows that a realistic Active Directory intrusion is still enough to expose major weaknesses in detection engineering and incident reporting.
• The attack path combined password spraying, hidden admin creation, credential dumping, WMI movement, and domain controller replication across five hosts.
• Teams need correlated identity, endpoint, and directory controls, because single-event detections are not enough to explain or stop chained intrusion paths.

Key terms

• Active Directory Intrusion Path: The sequence an attacker follows to move from initial access to privilege abuse and domain control inside a Windows environment. In practice, it links authentication, account manipulation, credential theft, and lateral movement into one chain that defenders must detect as a whole.
• Credential Dumping: Credential dumping is the extraction of authentication material from storage, memory, or system components after an attacker has found a way to force exposure. The stolen material may be hashed, encrypted, or plaintext, but it becomes dangerous once it can be cracked, replayed, or sold for later access.
• Correlation Rule: A correlation rule is a detection logic that flags when multiple events or alerts occur together in a pattern that suggests higher risk. Rather than treating each signal separately, it combines timing, source, and context to surface incidents that deserve escalation. This is especially useful when single alerts are not urgent on their own.
• Report Synthesis: The process of turning raw investigation evidence into a coherent incident narrative with chronology, scope, and impact. It is a core response function because leaders need a defensible account of what happened, not just a list of alerts or isolated technical findings.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners who need to connect identity controls to operational risk. It is suited to teams that must govern access lifecycles, privilege, and credential exposure across modern environments.