From fa5b44c3904173c7bf33cd22d7b8ba76238c4e40 Mon Sep 17 00:00:00 2001
From: keyboardcrunch <40863898+keyboardcrunch@users.noreply.github.com>
Date: Fri, 18 Dec 2020 13:39:22 -0600
Subject: [PATCH] Create disable_or_modify_service_execution.yml

---
 .../disable_or_modify_service_execution.yml     | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 queries/windows/disable_or_modify_service_execution.yml

diff --git a/queries/windows/disable_or_modify_service_execution.yml b/queries/windows/disable_or_modify_service_execution.yml
new file mode 100644
index 0000000..90448fd
--- /dev/null
+++ b/queries/windows/disable_or_modify_service_execution.yml
@@ -0,0 +1,17 @@
+title: Disable or Modify Service Execution
+description: Detect the modification of service start type for defense evasion. Tuning will be required as many installers and updaters change service states.
+author: keyboardcrunch
+date: 18/12/2020
+modified:
+mitre: 
+   tactic: Defense Evasion
+   technique: T1562
+   subtechnique: 001
+operating_system: windows
+query: (RegistryKeyPath RegExp "\bMACHINE\\SYSTEM\\.*ControlSet.*\\Services\\.*\\Start" AND EventType = "Registry Value Modified") AND SrcProcParentName Not In ("services.exe","svchost.exe","smss.exe","WmiPrvSE.exe","wininit.exe","TiWorker.exe","msiexec.exe","OfficeClickToRun.exe") AND SrcProcName Not In ("GoogleUpdate.exe")
+false_positives:
+   - Updater services such as those for Chrome/Edge
+   - MSI installations
+   - Explicitly adjusted service states
+tags:
+references: