Potential EDR-Freeze via WerFaultSecure Abuse

  1[metadata]
  2creation_date = "2026/06/03"
  3integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "m365_defender"]
  4maturity = "production"
  5updated_date = "2026/06/03"
  6
  7[rule]
  8author = ["Aryu Zaw"]
  9description = """
 10Identifies the Windows Error Reporting Protected Process Light (PPL) binary WerFaultSecure.exe being started by a
 11process other than the Windows Error Reporting service, with command-line arguments used to take a secure memory dump of
 12a target process. Because MiniDumpWriteDump suspends all threads of the target while the dump is produced, an attacker
 13can suspend WerFaultSecure.exe mid-dump to leave the targeted EDR or antivirus suspended ("frozen") without ever
 14terminating it, a defense-evasion technique publicly known as EDR-Freeze.
 15"""
 16false_positives = [
 17    """
 18    Specialized crash-analysis, debugging, or diagnostics tooling that invokes WerFaultSecure.exe directly to capture a
 19    secure process dump. Validate the parent process, its code signature, and the targeted process before adding an
 20    exception.
 21    """,
 22]
 23from = "now-9m"
 24index = [
 25    "winlogbeat-*",
 26    "logs-endpoint.events.process-*",
 27    "logs-windows.sysmon_operational-*",
 28    "endgame-*",
 29    "logs-sentinel_one_cloud_funnel.*",
 30    "logs-m365_defender.event-*",
 31]
 32language = "eql"
 33license = "Elastic License v2"
 34name = "Potential EDR-Freeze via WerFaultSecure Abuse"
 35note = """## Triage and analysis
 36
 37### Investigating Potential EDR-Freeze via WerFaultSecure Abuse
 38
 39`WerFaultSecure.exe` is the Protected Process Light (PPL) variant of Windows Error Reporting, normally launched by the WER service hosted in `svchost.exe` to capture secure crash dumps of protected processes. Because it runs as a PPL and can read the memory of other protected processes, adversaries abuse it to dump or freeze security software.
 40
 41In the EDR-Freeze technique, an attacker starts `WerFaultSecure.exe` from their own process and directs it to dump a security process (for example `MsMpEng.exe`). `MiniDumpWriteDump` suspends every thread of the target while the dump is produced; the attacker then suspends `WerFaultSecure.exe` itself at that moment, leaving the EDR or antivirus frozen in a "coma" without ever terminating it, so traditional process-termination and tamper alerts never fire.
 42
 43This rule identifies `WerFaultSecure.exe` started by a parent other than the WER service with command-line arguments characteristic of a secure process memory dump (`/pid` and `/encfile`). Legitimate secure dumps are initiated by the WER service, so an abnormal parent process is the primary signal of abuse.
 44
 45### Possible investigation steps
 46
 47- Identify the parent process via `process.parent.name`, `process.parent.executable`, and `process.parent.command_line`. Launches from shells, scripting engines, `rundll32.exe`, or unsigned binaries in user-writable paths are highly suspicious.
 48- Resolve the target process from the `/pid` argument value and determine whether it corresponds to a security product (EDR or antivirus such as `MsMpEng.exe`), `lsass.exe`, or another sensitive process.
 49- Review the full command line for the dump-type value (the public proof of concept uses `/type 268310`, a full dump) and for the `/cancel` event handle, which together with `/encfile` indicate a full secure memory dump.
 50- Look for a ProcessAccess event (Sysmon Event ID 10) or an Elastic Defend API event in which `WerFaultSecure.exe` is opened with `PROCESS_SUSPEND_RESUME` (access mask `0x800` / `2048`) by a non-WER process shortly after this execution. This is the act that freezes the dumper and keeps the target suspended.
 51- Check whether the targeted security agent stopped reporting telemetry (a heartbeat gap) around the time of the alert.
 52- Examine the parent process for prevalence, code signature, on-disk location, and any preceding download, injection, or privilege-escalation activity.
 53- Review activity for the user and host over the preceding 24-48 hours for related defense-evasion, credential-access, or lateral-movement behavior.
 54
 55### False positive analysis
 56
 57- This activity is highly unusual: secure WER dumps are normally initiated by the WER service in `svchost.exe`, not by interactive or third-party processes, so benign matches are rare.
 58- Specialized crash-analysis, debugging, or enterprise diagnostics tooling could invoke `WerFaultSecure.exe` directly. If such a tool is confirmed and authorized, add an exception scoped to its `process.parent.executable` and code signature.
 59
 60### Response and remediation
 61
 62- Isolate the affected host to prevent further post-compromise activity while the EDR or antivirus may be suspended.
 63- Verify the state of the targeted security agent and restart or resume it, then confirm that protection and telemetry have been restored.
 64- Terminate the suspicious `WerFaultSecure.exe` process and its parent, preserving command lines, handles, and any dump files for analysis.
 65- Investigate the parent process and its origin to determine the initial access vector and scope of compromise, and search the environment for the same parent binary or behavior on other hosts.
 66- Reset credentials that may have been exposed while the security agent was disabled, and run a full scan once protection is restored.
 67- Escalate to incident response when the targeted process is a security control, as a successful freeze indicates a hands-on-keyboard defense-evasion attempt.
 68"""
 69references = [
 70    "https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html",
 71    "https://binarydefense.com/resources/blog/dont-freeze-me-out-bro-arc-labs-technical-analysis-of-edr-freeze",
 72    "https://www.bleepingcomputer.com/news/security/new-edr-freeze-tool-uses-windows-wer-to-suspend-security-software/",
 73]
 74risk_score = 73
 75rule_id = "7b75c162-d439-472d-b39f-2eb0d4d2d318"
 76setup = """## Setup
 77
 78This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 79
 80Setup instructions: https://ela.st/install-elastic-defend
 81
 82### Additional data sources
 83
 84This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 85
 86- [Microsoft Defender XDR](https://ela.st/m365-defender)
 87- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 88- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 89"""
 90severity = "high"
 91tags = [
 92    "Domain: Endpoint",
 93    "OS: Windows",
 94    "Use Case: Threat Detection",
 95    "Tactic: Defense Evasion",
 96    "Data Source: Elastic Endgame",
 97    "Data Source: Elastic Defend",
 98    "Data Source: Microsoft Defender XDR",
 99    "Data Source: Sysmon",
100    "Data Source: SentinelOne",
101    "Resources: Investigation Guide",
102]
103timestamp_override = "event.ingested"
104type = "eql"
105
106query = '''
107process where host.os.type == "windows" and event.type == "start" and
108  process.executable : "?:\\Windows\\System32\\WerFaultSecure.exe" and
109
110  /* WerFaultSecure secure dumps are normally initiated by the WER service hosted in svchost.exe */
111  process.parent.executable != null and
112  not process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\wermgr.exe", "?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\System32\\WerFaultSecure.exe") and
113
114  /* arguments used to take a secure memory dump of a target process (e.g. /pid <target> /encfile <handle> /type 268310) */
115  process.args : "/pid" and process.args : "/encfile"
116'''
117
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121[[rule.threat.technique]]
122id = "T1562"
123name = "Impair Defenses"
124reference = "https://attack.mitre.org/techniques/T1562/"
125[[rule.threat.technique.subtechnique]]
126id = "T1562.001"
127name = "Disable or Modify Tools"
128reference = "https://attack.mitre.org/techniques/T1562/001/"
129
130
131
132[rule.threat.tactic]
133id = "TA0005"
134name = "Defense Evasion"
135reference = "https://attack.mitre.org/tactics/TA0005/"