Service Manipulation

Use Windows sc.exe with a remote server argument to register a service and start it on a target host. Configuring start= auto also schedules the service to start during system boot. The service binary must already exist on the target and be compatible with the Windows service model; sc.exe registers its path but does not copy it. The service runs under its configured account. Successful registration or a running state does not establish the payload's intended behavior or command-and-control.