detecting-credential-dumping-techniques

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs configuring Sysmon and Windows audit policy and forwarding logs (system-level changes that require administrative privileges), so it directs changing the machine's state.