defender-for-identity

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs installing sensors/MSIs on domain controllers, configuring Directory Service Accounts (gMSAs), modifying DC auditing/settings, and creating honeytoken/high-privilege accounts — all actions that change system state and require privileged/admin access.