examples:

• description: "Execute SecurityHealthService.exe unprotects LSA and observe the unusual behavior" command: "SecurityHealthService.exe unprotects LSA"

SecurityHealthService.exe unprotects LSA

Who needs protection? Not LSA!

Sets HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to 0 (= insecure = might raise EDR alerts ahem ahem) just before setting it (back?) to 2 for no valid reason.

Contributed by 59e5aaf4