threat-hunting

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs executing offensive tests (e.g., Invoke-AtomicTest for LSASS dumps, scheduled tasks, service installs) and running/evaluating detection rules that will modify host state and may require elevated privileges, so it encourages actions that can compromise the machine.