Service persistence

sc.exe create Update binPath= "C:\payload.exe" start= auto

Registers the payload as a Windows service with automatic startup: the binary runs as SYSTEM on every boot.

Use it when you need persistence with SYSTEM privileges on servers: the service is created and starts on its own, without relying on a user session. It's the classic way to escalate from local admin to SYSTEM if the service binary is replaceable.

If the SOC has 7045/4697 rules (the most common in Windows environments), creation triggers instantly. Don't use it on hosts with hardening that requires signed services or ImagePath validated by policy.