Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (<code>services.exe</code>) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as <code>sc.exe</code> and [Net](https://attack.mitre.org/software/S0039).

[PsExec](https://attack.mitre.org/software/S0029) can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.(Citation: Russinovich Sysinternals) Tools such as [PsExec](https://attack.mitre.org/software/S0029) and <code>sc.exe</code> can accept remote servers as arguments and may be used to conduct remote execution.

Adversaries may leverage these mechanisms to execute malicious content. This can be done by either executing a new or modified service. This technique is the execution used in conjunction with [Windows Service](https://attack.mitre.org/techniques/T1543/003) during service persistence or privilege escalation.
Service Execution
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1569/002  external_id: T1569.002     source_name: Microsoft Service Control Manager  description: Microsoft. (2018, May 31). Service Control Manager. Retrieved March 28, 2020.  url: https://docs.microsoft.com/windows/win32/services/service-control-manager     source_name: Russinovich Sysinternals  description: Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11. Retrieved May 13, 2015.  url: https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx     