diff --git a/queries/windows/disable_or_modify_service_execution.yml b/queries/windows/disable_or_modify_service_execution.yml
new file mode 100644
index 0000000..90448fd
--- /dev/null
+++ b/queries/windows/disable_or_modify_service_execution.yml
@@ -0,0 +1,17 @@
+title: Disable or Modify Service Execution
+description: Detect the modification of service start type for defense evasion. Tuning will be required as many installers and updaters change service states.
+author: keyboardcrunch
+date: 18/12/2020
+modified:
+mitre: 
+   tactic: Defense Evasion
+   technique: T1562
+   subtechnique: 001
+operating_system: windows
+query: (RegistryKeyPath RegExp "\bMACHINE\\SYSTEM\\.*ControlSet.*\\Services\\.*\\Start" AND EventType = "Registry Value Modified") AND SrcProcParentName Not In ("services.exe","svchost.exe","smss.exe","WmiPrvSE.exe","wininit.exe","TiWorker.exe","msiexec.exe","OfficeClickToRun.exe") AND SrcProcName Not In ("GoogleUpdate.exe")
+false_positives:
+   - Updater services such as those for Chrome/Edge
+   - MSI installations
+   - Explicitly adjusted service states
+tags:
+references: