I am trying to do a proof of concept where I use technique T1574.010. In this technique, I should rewrite the binpath of some service in Windows 10 so that when the service starts again the payload that I want is executed, which in this case is calc.exe.

My first question is which service should I use in Windows 10? I didn't know which one to use so I created a new service like this one: https://gist.github.com/mmmunk/0b0adbccb6b91e778e3a6c6b47908c9c

This service writes in the file C:\Windows\Temp\TempLogger.log "Hej" while executing. In this case, I want it to execute the calc.exe but I couldn't make it work.

The second question is why this service works fine but why does calc doesn't execute?

Is there any other option to do the proof of concept of this technique?

  • Your question appears to be asking us to debug your program. That's not what we do here.
    – schroeder
    Commented Sep 10, 2023 at 19:03
  • I don't understand how you came to that conclusion, especially considering that I made multiple questions and all of them are about concepts or ideas, not the code.
    – P00
    Commented Sep 12, 2023 at 20:00
  • If it isn't about the code, why include it? Twice? And then why mention how the code works, and then all the things that don't work about the code....?
    – schroeder
    Commented Sep 12, 2023 at 20:09
  • Why don't you look for a service that's known to have this vulnerability? Why make your own? For instance, I googled your question title and got: posts.specterops.io/… and feedly.com/cve/CVE-2018-20621 and kb.prohacktive.io/en/…
    – schroeder
    Commented Sep 12, 2023 at 20:12
  • If I then modify the search to ask google.com/search?q=cves+with+T1574.010, I get a lot more...
    – schroeder
    Commented Sep 12, 2023 at 20:16


You must log in to answer this question.