Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

Tactics
TA0003 TA0004

Sub-technique of
T1543


See: MITRE ATT&CK