CmdID / PowerShell / Cmdlets / New
New-Service
Creates a new Windows service. PowerShell reference
From the PowerShell reference 9 parameters 2 Sigma rules look for it
What it does
Creates a new Windows service. The New-Service cmdlet creates a new entry for a Windows service in the registry and in the service database. A new service requires an executable file that runs during the service. The parameters of this cmdlet let you set the display name, description, startup type, and dependencies of the service.
New-Service [-Name] <String> [-BinaryPathName] <String> [-DisplayName <String>] [-Description <String>] [-StartupType <ServiceStartMode>] [-Credential <PSCredential>] [-DependsOn <String[]>] [-WhatIf] [-Confirm] [<CommonParameters>]Create a service
New-Service -Name "TestService" -BinaryPathName 'C:\WINDOWS\System32\svchost.exe -k netsvcs'IdentifyTrips 2 Sigma rules: highSuspicious New Service Creation by Nasreddine Bencherchali (Nextron Systems); lowNew Service Creation Using PowerShell by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
Create a service that includes description, startup type, and display name
$params = @{
Name = "TestService"
BinaryPathName = 'C:\WINDOWS\System32\svchost.exe -k netsvcs'
DependsOn = "NetLogon"
DisplayName = "Test Service"
StartupType = "Manual"
Description = "This is a test service."
}
New-Service @paramsIdentifyView the new service
Get-CimInstance -ClassName Win32_Service -Filter "Name='testservice'"IdentifyDelete a service
sc.exe delete TestService
# - or -
(Get-CimInstance -Class Win32_Service -Filter "name='TestService'").Delete()IdentifyIts page in the reference: New-Service.
Parameters
-BinaryPathNameSpecifies the path of the executable file for the service. This parameter is required.
The fully qualified path to the service binary file. If the path contains a space, it must be quoted so that it is correctly interpreted. For example, D:\my share\myservice.exe should be specified as '"D:\my share\myservice.exe"'.
The path can also include arguments for an auto-start service. For example, '"D:\my share\myservice.exe" arg1 arg2'. These arguments are passed to the service entry point.
For more information, see the lpBinaryPathName parameter of CreateServiceW API.-CredentialSpecifies the account used by the service as the Service Logon Account.
Credentials are stored in a PSCredential object and the password is stored as a SecureString.
NOTE: For more information about SecureString data protection, see How secure is SecureString?.-DependsOnSpecifies the names of other services upon which the new service depends. To enter multiple service names, use a comma to separate the names.-DescriptionSpecifies a description of the service.-DisplayNameSpecifies a display name for the service.-NameSpecifies the name of the service. This parameter is required.-StartupTypeSets the startup type of the service. The acceptable values for this parameter are:
- Automatic - The service is started or was started by the operating system, at system start-up.
If an automatically started service depends on a manually started service, the manually started
service is also started automatically at system startup.
- Disabled - The service is disabled and cannot be started by a user or application.
- Manual - The service is started only manually, by a user, using the Service Control Manager,
or by an application.
- Boot - Indicates that the service is a device driver started by the system loader. This
value is valid only for device drivers.
- System - Indicates that the service is a device driver started by the 'IOInitSystem()'
function. This value is valid only for device drivers.
The default value is Automatic.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.