EDR-Freeze Tool Technical Workings Along With Forensic Artifacts Revealed
A recent analysis by researcher Itamar Hällström has detailed the technical mechanisms and forensic evidence associated with the "EDR-Freeze," a proof-of-concept technique that temporarily disables security software.
A recent analysis by researcher Itamar Hällström has detailed the technical mechanisms and forensic evidence associated with the "EDR-Freeze," a proof-of-concept technique that temporarily disables security software.
This method exploits legitimate Windows components to place Endpoint Detection and Response (EDR) and antivirus (AV) processes into a temporary, reversible suspension, allowing unauthorized activity to occur undetected.
The EDR-Freeze technique misuses the Windows Error Reporting (WER) system to achieve its objectives. Unlike other evasion tools that require vulnerable drivers for kernel-level privileges, this method functions entirely within user mode.
The process begins with the EDR-Freeze tool executing a legitimate Microsoft executable, WerFaultSecure.exe . This process is instructed to create a minidump of a target security process, such as Windows Defender’s MsMpEng.exe .
A significant side effect of using the DbgHelp's MiniDumpWriteDump function to create the minidump is the suspension of all threads in the target process.
The EDR-Freeze tool exploits this by initiating the dump and maintaining it in a suspended state for a configurable period, effectively pausing the EDR without causing a crash.
Once the specified period has elapsed, the operation is cleanly aborted, and the security process resumes normal operation, leaving minimal traces in standard logs.
The EDR-Freeze technique misuses the Windows Error Reporting (WER) system to achieve its objectives.
Despite its stealth, the EDR-Freeze technique leaves distinct artifacts in a system’s memory. A forensic analysis of a memory image can reveal the entire sequence of events.
Tools can identify suspended threads within the target EDR process and correlate their creation times with the activity of the WerFaultSecure.exe process. Investigators can also examine process handles, which act as permissions.
The WerFaultSecure.exe process holds a handle to the EDR process with specific access rights, including PROCESS_SUSPEND_RESUME , indicating its purpose.
Command-line arguments provide additional evidence, showing the EDR-Freeze tool passing the target process ID (PID) to WerFaultSecure.exe .
Moreover, the technique creates transient files, such as t.txt , during its operation. Although these files are deleted upon completion, their presence in a memory dump serves as a valuable forensic lead.
Defenders can actively search for this activity using custom detection rules. YARA rules have been developed to identify both the EDR-Freeze binary and its behavioral patterns in memory.
A binary-focused rule can identify a combination of strings related to the WerFaultSecure.exe command-line flags and API imports for process manipulation, such as CreateFileW and CreateEventW .
A behavior-focused rule can scan system memory for a cluster of suspicious indicators, such as privilege escalation APIs and process suspension functions used together.
This investigation highlights a significant evolution in attacker techniques: rather than terminating security tools, they can pause them, demonstrating that even Protected Process Light (PPL) processes can be manipulated, turning trusted system components into tools for attack.
Detecting these attacks necessitates that defenders move beyond endpoint alerts and incorporate memory forensics into their incident response workflows.
Based on reporting by Cyber Security News.