EDR-Freeze: Technical Mechanics and Forensic Artifacts Exposed
EDR-Freeze is a proof-of-concept tool designed to temporarily suspend endpoint detection and response (EDR) or antivirus processes. This tool utilizes legitimate Windows Error Reporting components, specifically WerFaultSecure.exe and the…
EDR-Freeze is a proof-of-concept tool designed to temporarily suspend endpoint detection and response (EDR) or antivirus processes. This tool utilizes legitimate Windows Error Reporting components, specifically WerFaultSecure.exe and the MiniDumpWriteDump API, to pause security processes from user mode without installing a vulnerable driver.
EDR-Freeze operates by launching WerFaultSecure.exe under Windows Error Reporting. It employs a technique where the threads are timed precisely to suspend all worker threads in the target process, effectively halting telemetry while keeping the process alive. After a configurable delay, the process resumes, often without triggering alerts.
The tool targets processes like MsMpEng.exe (Windows Defender) by loading dbghelp.dll and invoking MiniDumpWriteDump, which suspends every thread in the target process during dump creation. This suspension is achieved by passing handles directly to the target’s threads. In Process Explorer, both WerFaultSecure.exe and MsMpEng.exe appear as suspended, indicating the stealthy nature of this technique.
Memory analysis reveals that the freeze is evident through the suspended timestamps of MsMpEng.exe threads and WerFaultSecure.exe. Volatility’s windows.handles plugin shows WerFaultSecure.exe opening a PROCESS_SUSPEND_RESUME handle on MsMpEng.exe, allowing precise thread control.
EDR-Freeze is a proof-of-concept tool designed to temporarily suspend endpoint detection and response (EDR) or antivirus processes.
During execution, the processes temporarily open a file handle to t.txt in the user's Desktop folder, which serves as a forensic indicator. The import address table (IAT) of WerFaultSecure.exe statically imports MiniDumpWriteDump from dbghelp.dll, confirming its capability to suspend threads on demand.
Investigators are advised to preserve remnants of t.txt and its timestamps, as well as IAT entries indicating MiniDumpWriteDump usage. Static YARA rules targeting WerFaultSecure.exe can identify key command-line flags and imports associated with the tool, aiding in endpoint detection.
EDR-Freeze illustrates how attackers can exploit trusted OS components to disrupt security tools without requiring kernel exploits. By inducing a reversible suspension of processes, adversaries gain stealth advantages during critical operations. It is crucial for defenders to engage in memory forensics and behavioral analyses to detect such transient pauses, maintaining security control visibility during incident response.
Based on reporting by GBHackers.