Activity evidence packet P-6
Label: original fictional packet. No file was changed.

Asset: files-3.lab.invalid, NightIndex service
Checked: service-permissions.csv
Observation: NightIndex is recorded as LocalSystem. lea has write on run.bat. The service program is run.bat.
Not observed: the service was not restarted, and the file was not edited.
Impact supported by this packet: lea could change the program a LocalSystem service is configured to start.
Impact not supported: no proof of what would happen after a restart, because the restart was not done.
Repair that fits the observation: remove lea's write on run.bat, then read the permission rows again.
Retest that fits the repair: the new read should show no write for lea. Do not start the service.
Scope: this packet only.