SCMExec
How It Works
The Service Control Manager Remote Protocol (SCMR) is an RPC-based protocol for configuring and controlling Windows services on a remote computer. With sufficient permissions, an operator can create or reconfigure a service whose binary path contains a command and then start that service to execute the command remotely.[1]
If no service account is specified, CreateService uses LocalSystem, which has extensive local privileges. This explains the high impact of successful SCM execution. It does not inherently disable UAC or Microsoft Defender: the caller still needs remote SCM rights, and endpoint controls can inspect or block the service or payload.[3][4]
Tools
SharpMove supports authenticated remote execution through SCM and several other Windows mechanisms. The following example selects its SCM action, creates a service named WindowsDebug, and points it at a payload already present on the remote host.[2]
SharpMove.exe action=scm computername=remote.host.local command="C:\windows\temp\payload.exe" servicename=WindowsDebug amsi=true