{"id":"387df17d-3b04-448f-8669-9e7fd5e5fd8c","title":"Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze","description":"Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.\nThis technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_access","product":"windows","definition":"Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.\nExample sysmon config snippet with grouping, as logging individual ProcessAccess events can generate excessive logs:\n<ProcessAccess onmatch=\"include\">\n    <Rule groupRelation=\"and\">\n    <TargetImage condition=\"end with\">\\MsMpEng.exe</TargetImage>\n    <SourceImage condition=\"end with\">\\WerFaultSecure.exe</SourceImage>\n    </Rule>\n</ProcessAccess>\n"},"falsepositives":["Legitimate Windows Error Reporting operations"],"references":["https://blog.axelarator.net/hunting-for-edr-freeze/"],"source_path":"rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access.yml","source_sha256":"23efcbb8337a8d991a87f4a09dc5fa8de37d7d53080127693544e4fe531efe2b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze\nid: 387df17d-3b04-448f-8669-9e7fd5e5fd8c\nrelated:\n    - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b\n      type: similar\n    - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2\n      type: similar\nstatus: experimental\ndescription: |\n    Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.\n    This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.\nreferences:\n    - https://blog.axelarator.net/hunting-for-edr-freeze/\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-27\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_access\n    product: windows\n    definition: |\n        Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.\n        Example sysmon config snippet with grouping, as logging individual ProcessAccess events can generate excessive logs:\n        <ProcessAccess onmatch=\"include\">\n            <Rule groupRelation=\"and\">\n            <TargetImage condition=\"end with\">\\MsMpEng.exe</TargetImage>\n            <SourceImage condition=\"end with\">\\WerFaultSecure.exe</SourceImage>\n            </Rule>\n        </ProcessAccess>\ndetection:\n    selection:\n        SourceImage|endswith: '\\WerFaultSecure.exe'\n        TargetImage|endswith: '\\MsMpEng.exe'\n        CallTrace|contains:\n            - '\\dbgcore.dll'\n            - '\\dbghelp.dll'\n    condition: selection\nfalsepositives:\n    - Legitimate Windows Error Reporting operations\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/387df17d-3b04-448f-8669-9e7fd5e5fd8c.json","kind":"sigma"}