Security researchers have unveiled a sophisticated new attack method called EDR-Freeze that can disable endpoint detection and response (EDR) tools and antivirus software without requiring kernel-level access or vulnerable drivers.
## The Innovation Behind EDR-Freeze
Developed by security researcher TwoSevenOneThree (Zero Salarium), EDR-Freeze represents a significant shift from traditional EDR evasion techniques. Unlike conventional methods that rely on “Bring Your Own Vulnerable Driver” (BYOVD) attacks, this new approach operates entirely from user mode and leverages legitimate Windows components.
Traditional BYOVD attacks face several challenges:
– Smuggling vulnerable drivers onto target systems
– Bypassing execution protections
– Removing kernel-level evidence of the attack
EDR-Freeze eliminates these complications by using built-in Windows functionality, making it considerably stealthier and harder to detect.
## How the Attack Works
The technique exploits two legitimate Windows components:
**WerFaultSecure**: A Windows Error Reporting component that runs with Protected Process Light (PPL) privileges, designed to collect crash dumps from sensitive system processes.
**MiniDumpWriteDump**: An API that creates memory snapshots of processes, temporarily suspending all threads during the operation.
The attack follows a four-step process:
1. Launch WerFaultSecure with PPL privileges
2. Configure it to target a specific security process using MiniDumpWriteDump
3. Monitor the target process until it becomes suspended during the dump operation
4. Immediately suspend the WerFaultSecure process itself, preventing it from resuming the target
This creates a “race condition” that leaves security tools in a permanent suspended state—effectively putting them into a “coma.”
## Real-World Testing
The researcher successfully tested EDR-Freeze on Windows 11 24H2, demonstrating its ability to freeze Windows Defender processes. The attack exploits intended behavior rather than actual vulnerabilities, making it a design weakness rather than a traditional security flaw.
## Defense Strategies
Security professionals can implement several countermeasures:
– **Process Monitoring**: Watch for WER processes targeting sensitive system processes like LSASS or security tools
– **Behavioral Analysis**: Security researcher Steven Lim has developed tools to map WerFaultSecure activities to Microsoft Defender processes
Microsoft could strengthen defenses by:
– Blocking suspicious WER invocations
– Restricting which processes can be targeted
– Limiting allowable parameters for these operations
## Industry Impact
This discovery highlights the ongoing cat-and-mouse game between attackers and defenders in cybersecurity. By using legitimate Windows functionality, EDR-Freeze demonstrates how creative threat actors can find new ways to bypass security measures without traditional exploitation techniques.
The research underscores the importance of monitoring system behavior beyond just looking for known malicious signatures, as attackers increasingly leverage legitimate tools for malicious purposes.