active-directory-technique

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill is an offensive AD attack playbook that directs the agent to create a backdoor local admin account, change system registry settings (WDigest), run sudo-privileged sniffing, and install domain persistence such as AdminSDHolder ACL changes and Skeleton Key, all of which alter machine and domain state.