Loading story…
A new proof-of-concept tool, EDR-Freeze, demonstrates a method to suspend EDR and antivirus processes using only user-mode access via Windows Error Reporting (WER). The technique leverages a race condition involving WerFaultSecure and MiniDumpWriteDump, leaving security software in a suspended state without requiring a vulnerable driver. This approach highlights a design weakness in Windows and suggests defenders should monitor WER activity targeting sensitive processes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting emphasized that EDR-Freeze could circumvent security software and drew wider attention to the risks the technique poses to endpoint defenses. This marked an escalation in awareness beyond the initial disclosure.
Multiple security news outlets disclosed technical details of EDR-Freeze, reporting that the tool could be used to bypass or neutralize security software by leveraging Windows Error Reporting behavior. The coverage established the technique as a novel defensive-evasion method affecting Windows security products.
A security researcher created EDR-Freeze, a tool that abuses Windows Error Reporting to suspend or freeze endpoint security and antivirus processes. The technique was presented as a way to circumvent EDR protections without directly terminating protected processes.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new security threat has emerged with the discovery of the EDR-Freeze tool, which targets Endpoint Detection and Response (EDR) and antivirus solutions by exploiting a vulnerability in the Windows Error Reporting (WER) system. The tool, developed by Zero Salarium, leverages a specific flaw in WER to suspend or incapacitate security processes, effectively putting EDR and antivirus software into a 'coma state.' This technique allows attackers to bypass critical security controls, increasing the risk of undetected malicious activity on compromised systems. Security researchers have highlighted the cleverness of this attack, noting that it can be used to facilitate further exploitation or persistence by threat actors. In response to the identification of EDR-Freeze, the detection engineering community has rapidly developed and deployed new detection rules across multiple platforms. SigmaHQ and Yamato-Security have both updated their Sigma and Hayabusa rule sets to specifically identify the abuse of WerFaultSecure.exe, which is central to the EDR-Freeze technique. These rules are designed to detect the suspension of security processes, a hallmark of the EDR-Freeze attack. The rapid integration of these detection rules demonstrates the agility of the security community in responding to emerging threats. Additionally, the new rules are being incorporated into a variety of detection platforms, including Elastic, YARA, and KQL, to ensure broad coverage across different security environments. The focus on defense evasion tactics in recent detection rule updates underscores the growing sophistication of attackers and the need for continuous improvement in security monitoring. Organizations are advised to update their detection content to include these new rules and to monitor for suspicious activity involving WerFaultSecure.exe. The incident has also prompted discussions about the need for more robust protections within the Windows Error Reporting system to prevent similar abuses in the future. Security teams are encouraged to review their endpoint security configurations and ensure that their EDR and antivirus solutions are resilient against process suspension attacks. The EDR-Freeze case highlights the importance of collaboration between security researchers, detection engineers, and vendors in rapidly addressing new attack techniques. As attackers continue to innovate, defenders must remain vigilant and proactive in adapting their detection and response strategies. The emergence of EDR-Freeze serves as a reminder that even trusted system components like WER can be weaponized by adversaries. Ongoing threat intelligence sharing and rule development are critical to maintaining effective defenses against evolving threats. The security community's swift response to EDR-Freeze demonstrates the value of open-source detection rule repositories and collaborative defense efforts.
Jun 29, 2026
Elastic Security Labs warned that ransomware operators increasingly use legitimately signed but vulnerable Windows drivers to gain kernel-mode execution, tamper with endpoint defenses, and encrypt systems. The researchers identified an unrestricted handle-duplication flaw in the Microsoft Sysinternals Process Explorer driver that a user-mode attacker could exploit to access raw physical memory, enabling arbitrary kernel read/write operations or kernel code execution. Organizations should treat vulnerable signed drivers as a high-risk attack path and block known-abused drivers before they load. Elastic recommends combining vulnerable-driver blocklists, Windows Defender Application Control (WDAC) driver allowlisting, behavioral protections, and monitoring for first-seen or anomalous driver loads; Elastic Endpoint 8.3 and later validates drivers against its blocklist prior to loading.
Aug 26, 2026
Two separate Windows-focused research writeups describe practical **evasion techniques against Microsoft Defender/EDR**. One demonstrates bypassing Defender’s signature-based detections by constructing suspicious strings (e.g., `Invoke-Mimikatz`) at runtime using PowerShell character encoding/concatenation (`[char]NN`), reporting reliable evasion in a fully updated Windows 10/11 environment with real-time protection and script scanning enabled. A second report covers **EDRStartupHinder**, a newly released tool by researcher **TwoSevenOneT** that aims to prevent antivirus/EDR services from starting cleanly on boot (demonstrated against Defender on Windows 11 25H2). The technique uses a higher-priority Windows service and **Bindlink** redirection of a selected `System32` DLL to a tampered (“corrupted”) copy so the protected EDR process (e.g., `MsMpEng.exe`, running as **PPL**) fails to load required dependencies and crashes at startup; the article notes operator requirements such as choosing a DLL not in `KnownDLLs` and identifying service group order via `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder` and tooling like Process Monitor/Process Explorer boot logs.
Jun 29, 2026