Guided Lab
Guided lab: a service that starts before you do
Windows services run as SYSTEM and start before anyone logs in, which makes them the most valuable persistence on the box and the hardest to spot among the two hundred already there. Part three of the persistence series.
T1543.003