Sc.exe · LOLBAS

01 / TRADECRAFT

Command reference

2 examples

ADS2

Creates a new service and executes the file stored in the ADS.

COMMAND

sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice

USE CASE: Execute binary file hidden inside an alternate data stream
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · EXE

EXAMPLE 02T1564.004

Modifies an existing service and executes the file stored in the ADS.

COMMAND

sc config {ExistingServiceName} binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" & sc start {ExistingServiceName}

USE CASE: Execute binary file hidden inside an alternate data stream
PRIVILEGES: User
OPERATING SYSTEM: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Execute · EXE

02 / ON DISK

Known paths

C:\Windows\System32\sc.exe

C:\Windows\SysWOW64\sc.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

5 resources

Indicators & detection notes

IOC
Unexpected service creation
IOC
Unexpected service modification

Research & resources

READputting data in alternate data streams and how to execute it part 2oddvar.moe

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe