Hacktool - EDR-Freeze Execution

Title: Hacktool - EDR-Freeze Execution
Status: experimental
Description:Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
References:
  -https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
  -https://github.com/TwoSevenOneT/EDR-Freeze
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-24
modified:2025-11-27
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|contains:
      -'\EDR-Freeze'
      -'\EDRFreeze'

    Image|endswith: '.exe'
  selection_imphash:
    Hashes|contains:
      -'IMPHASH=1195F7935954A2CD09157390C33F8E8C'
      -'IMPHASH=129F58DE3D687FB7F012BF6C3D679997'
      -'IMPHASH=2C617A175D0086251642C6619F7CC8BA'
      -'IMPHASH=8828F0B906F7844358FB92A899E9520F'
      -'IMPHASH=AF76D95157EC554DC1EF178E4E66D447'
      -'IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5'
      -'IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0'
      -'IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7'

  condition:1 of selection_*
Falsepositives:
  -Unlikely
Level: high