| T1050 - New Service | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| Tools | sc.exe | PowerShell New-Service | Invoke-PSExec | CSExec | PSExec | SharpSC | reg.exe | regedit.exe | PS Registry Edit |
| Windows API | OpenSCManager/CreateService | RegKeyCreateEx/RegSetValueEx | |||||||
| RPC Interface/Named Pipe | 367ABB81-9844-35F1-AD32-98F038001003 [MS-SCMR] \\PIPE\svcctl | 338CD001-2244-31F1-AAAA-900038001003 [MS-RRP] \\PIPE\winreg | |||||||
| RPC Method | ROpenSCManager/RCreateService | BaseRegCreateKey | |||||||
| Registry Service Database | HKLM\SYSTEM\CurrentControlSet\Services | ||||||||