What Is EDR-Freeze, and Why It’s a Game Changer

EDR-Freeze was developed by researcher TwoSevenOneThree (Zero Salarium) as a proof-of-concept tool that **suspends** security agents (EDR, AV) rather than killing them outright.  The technique abuses **Windows Error Reporting (WER)** and **MiniDumpWriteDump**: when creating a memory dump of a target process, Windows temporarily suspends its threads. EDR-Freeze arranges for the dump to target the security process, then suspends the dumper itself—leaving the EDR in a frozen, unresumed state. 

Because EDR-Freeze uses legitimate, signed OS components (WER, WerFaultSecure, MiniDump APIs), many defenses will struggle to distinguish it from benign system behavior.  It does **not** require vulnerable kernel drivers or exploit techniques—it runs in user mode. 

Why This Trick Works on Modern Endpoints

• EDRs often protect themselves by marking their processes with **Protected Process Light (PPL)** or other defenses. EDR-Freeze includes logic to run the dump through a PPL-compatible child process, enabling it to target PPL-protected agents.
• The use of **WerFaultSecure.exe**, a signed system binary, hides the attack in seemingly normal OS activity. 
• When frozen, the EDR no longer processes events, reports, or alerts. Attackers can move, exfiltrate, or persist under a cloak of silence.
• Because the EDR remains “present” (not terminated), heuristics that look for process death or crashes may not trigger. The agent appears alive but is inert.

Real-World Evidence & Media Coverage

- ExtraHop covered it in a blog titled *“EDR-Freeze: The New Way Attackers Are Getting Into Your Network.”*  - Morphisec published a post *“EDR-Freeze: A New Attack Freezes Security Tools”* exploring its stealthy mechanics.  - SCWorld reported that popular security products (AV, EDR) might be evaded by this new tool, even on Windows 11.  - BinaryDefense (ARC Labs) published a technical analysis, confirming the suspension technique and detailing how attackers might exploit it. - HarfangLab described how advanced EDR self-protection mechanisms can defend against EDR-Freeze (by restricting access control and verifying requester processes). 

What Every CISO Must Do Right Now

Here’s a prioritized checklist and strategy to mitigate the risk and harden your defenses against EDR-Freeze and similar techniques:

1. Monitor for suspicious WerFaultSecure invocation: Hunt for command-line patterns like `WerFaultSecure.exe /encfile /cancel /pid /type` tied to untrusted processes. 
2. Track process suspend requests: Use process-access telemetry (Sysmon, EDR) to flag any non-EDR process calling `SuspendThread` or requesting PROCESS_SUSPEND_RESUME rights on your EDR binary.
3. Watch for transient file artifacts: The EDR-Freeze PoC uses a temp file (often named `t.txt`) as part of its dump handshake. Monitor file create/delete events in unusual locations. 
4. Monitor EDR heartbeat & telemetry gaps: If an EDR agent stops reporting or its metrics freeze, correlate that with concurrent WerFaultSecure or dumper activity.
5. Enable EDR self-protection: EDR vendors should block or refuse attempts from non-authorized processes to suspend their services. HarfangLab describes implementing such controls. 
6. Use independent network & detection layers: When EDR is frozen, your visibility must come from off-host sources—network monitoring, deception, anomaly detection, SIEM, etc.
7. Deploy Fileless/behavioral defense: Look for lateral movement, credential dumping, unusual outbound traffic—even if host defense is disabled.
8. Perform adversary emulation & red teaming: Test EDR resilience by simulating freeze techniques in a controlled environment to validate your defenders’ detection & response pipelines.

Architectural Defense Model (Layered Visibility)

User / Identity Auth  →  Device Integrity / Attestation  →  EDR / Endpoint Telemetry  
         │                        │                         │
         └──> Network Layer (NDR, BSP, TAP) — independent source of truth  
                    ↓
           SIEM / Analytics / Orchestration → Active Response

Monetizable Service / Solution Suggestion

Closing Thoughts

EDR-Freeze is more than a fancy exploit—it’s a signal. Attackers are evolving to take down the defenders themselves, exploiting the very systems meant to protect. For CISOs, the approach must shift: harden your EDR, build multiple visibility layers, and never trust your endpoint defense to be invincible.

Hashtags:

#CyberDudeBivash #EDRFreeze #EndpointSecurity #ThreatEvasion #CISOPlaybook #EvasionTechniques