Hacktool - EDR-Freeze Execution
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows.
Severity
Attention
Rule Requirement
Criteria
Action1:
actionname = "Process started" AND ((PROCESSNAME contains "\EDR-Freeze,\EDRFreeze" AND PROCESSNAME endswith ".exe") OR IMPHASH contains "1195F7935954A2CD09157390C33F8E8C,129F58DE3D687FB7F012BF6C3D679997,2C617A175D0086251642C6619F7CC8BA,8828F0B906F7844358FB92A899E9520F,AF76D95157EC554DC1EF178E4E66D447,E1B04316B61ACA31DD52ABBEC0A37FD5,8B2D5B54AFCFEC60D54F6B31D80ED4A0,AB8BB31EDD91D2A05FE7B62A535E9EB7")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME,Action1.DOMAIN,Action1.ORIGINALFILENAME,Action1.PARENTPROCESSID,Action1.PROCESSID,Action1.PRODUCT_NAME,Action1.SECURITYID
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@Swachchhanda Shrawan Poudel (Nextron Systems)
