Abuse Windows Service

Windows service configuration can establish persistence by registering a service or changing an existing service's executable path and startup type so the Service Control Manager launches it during system startup. This local sc.exe example assumes an authorized service-management context, a dedicated disposable test service (or captured pre-change configuration), and an existing Win32 executable that implements the service control protocol. The create example explicitly configures LocalSystem, a highly privileged local account; service configuration does not start the service immediately, and automatic execution occurs at system startup. This procedure does not establish an Internet-accessible management path.