Procedure examples

RemoteCMD can execute commands remotely by creating a new service on the remote system.

Ragnar Locker has used sc.exe to execute a service that it creates.

NotPetya can use PsExec to help propagate itself across a network.

HyperBro has the ability to start and stop a specified service.

Anchor can create and execute services to load its payload.

BBSRAT can start, stop, or delete services.

Clambling can create and start services on a compromised host.

DarkGate tries to elevate privileges to SYSTEM using PsExec to locally execute as a service, such as cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary].

LockBit 3.0 can use PsExec to execute commands and payloads.

Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.

Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.

Embargo has created a service named irnagentd that executed the MDeployer loader after the system is rebooted in Safe Mode.

gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.

Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.

Attor's dispatcher can be executed as a service.

HermeticWiper can create system services to aid in executing the payload.

Pysa has used PsExec to copy and execute the ransomware.

Pandora has the ability to install itself as a Windows service.

Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.

Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.

IPsec Helper is run as a Windows service in victim environments.

SysUpdate can manage services and processes.

ZxShell can create a new service for execution.

Winnti for Windows can run as a service using svchost.exe.

DEADWOOD can be executed as a service using various names, such as ScDeviceEnums.

LoudMiner started the cryptomining virtual machine as a service on the infected machine.

Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.

SLOTHFULMEDIA has the capability to start services.

HermeticWizard can use `OpenRemoteServiceManager` to create a service.

The net start and net stop commands can be used in Net to execute or stop Windows services.

Impacket contains various modules emulating other service execution tools such as PsExec.

Empire can use PsExec to execute a payload on a remote host.

PoshC2 contains an implementation of PsExec for remote execution.

xCmd can be used to execute binaries on remote systems by creating and starting a service.

Brute Ratel C4 can create Windows system services for execution.

Winexe installs a service on the remote system, executes the command, then uninstalls the service.

Koadic can run a command on another machine using PsExec.

Pupy uses PsExec to execute a payload or commands on a remote host.

Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.

TeamTNT has created system services to execute cryptocurrency mining software.

CanisterWorm has used executed `systemctl --user daemon-reload` to reload systemd, then enables and starts the malicious service.

During SharePoint ToolShell Exploitation, threat actors used Impacket to remotely stage and execute payloads via WMI.

During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network.

During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.

During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.

During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.

During the 2025 Poland Wiper Attacks, the adversaries had placed the malicious payload on an accessible network share to facilitate propagation.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used `move` to transfer files to a network share.

During Operation Wocao, threat actors used SMB to copy files to and from target systems.

During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable `msserver.exe` from a staging server to a local hard drive before deployment.