Endpoint security tools protect users against compromises. However, EDR-Freeze disables them via error messages within Windows without exploiting any vulnerabilities.
The approach revolves around WerFaultSecure, a Windows Error Reporting component with Protected Process Light (PPL) privileges. This service collects crash dumps from sensitive system processes so that they can be debugged. EDR-Freeze exploits the MiniDumpWriteDump API from the DbgHelp library. A security researcher with the screen name TwoSevenOneThree Zero Salarium discovered the danger and explains the potential exploits. The end result can lead to EDR tooling going “into a coma.”
When taking a memory snapshot of a process, all threads of the target process are temporarily suspended. Normally, these threads resume as soon as the dump is complete. EDR-Freeze uses a race condition: while WerFaultSecure is busy suspending the EDR process, WerFaultSecure itself is suspended before it can resume the threads.
Smarter approach than BYOVD
Traditional methods of bypassing EDR tools rely on Bring Your Own Vulnerable Driver (BYOVD) techniques. Attackers use legitimate but vulnerable kernel drivers for privilege escalation. However, this approach carries risks: smuggling drivers into target systems, bypassing execution security, and cleaning up kernel traces. All of this makes the chance of exploitation considerably smaller than is currently the case.
EDR-Freeze works differently. TwoSevenOneThree Zero Salarium developed a method that operates entirely from user mode. The technique uses Windows components that are standard in the operating system, eliminating the need for external drivers. Windows cannot detect this as malicious behavior because the processes in question could normally run one after the other.
Defense possible but limited
According to the researcher, defense can be achieved by monitoring whether WER refers to identifiers of sensitive processes such as LSASS or security tools. Security researcher Steven Lim has already developed a tool that links WerFaultSecure to Microsoft Defender Endpoint processes.
Microsoft could harden the Windows components against abuse by blocking suspicious calls, allowing only certain PIDs, or limiting possible parameters. However, as BleepingComputer pointed out, this is more of a design flaw than a real vulnerability within Windows. Furthermore, the actual likelihood of exploitation is unclear, so it is good news that a security researcher appears to have been the first to discover it. The EDR-Freeze tool was successfully tested on Windows 11 24H2, disabling the Windows Defender process.
Read also: Cybercriminal installs security software only to be found out by it