Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze — Sigma Rule

Rule metadata and linked tags

Author: Swachchhanda Shrawan Poudel (Nextron Systems). Source status: experimental; severity: high. Source dates: 2025-11-27 / not supplied.

{
  "category": "process_access",
  "product": "windows",
  "definition": "Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.\nExample sysmon config snippet with grouping, as logging individual ProcessAccess events can generate excessive logs:\n<ProcessAccess onmatch=\"include\">\n    <Rule groupRelation=\"and\">\n    <TargetImage condition=\"end with\">\\MsMpEng.exe</TargetImage>\n    <SourceImage condition=\"end with\">\\WerFaultSecure.exe</SourceImage>\n    </Rule>\n</ProcessAccess>\n"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 23efcbb8337a8d991a87f4a09dc5fa8de37d7d53080127693544e4fe531efe2b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
related:
    - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
      type: similar
    - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
      type: similar
status: experimental
description: |
    Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.
    This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.
references:
    - https://blog.axelarator.net/hunting-for-edr-freeze/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-27
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_access
    product: windows
    definition: |
        Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.
        Example sysmon config snippet with grouping, as logging individual ProcessAccess events can generate excessive logs:
        <ProcessAccess onmatch="include">
            <Rule groupRelation="and">
            <TargetImage condition="end with">\MsMpEng.exe</TargetImage>
            <SourceImage condition="end with">\WerFaultSecure.exe</SourceImage>
            </Rule>
        </ProcessAccess>
detection:
    selection:
        SourceImage|endswith: '\WerFaultSecure.exe'
        TargetImage|endswith: '\MsMpEng.exe'
        CallTrace|contains:
            - '\dbgcore.dll'
            - '\dbghelp.dll'
    condition: selection
falsepositives:
    - Legitimate Windows Error Reporting operations
level: high
regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/info.yml

Original YAML and metadata in JSON

False positives

• Legitimate Windows Error Reporting operations

Source references

• https://blog.axelarator.net/hunting-for-edr-freeze/