Hackers Deploy New EDR-Freeze Tool to Disable Security Software

A security researcher has released a new tool that can temporarily disable endpoint detection and response (EDR) systems and antivirus software without requiring vulnerable drivers. The tool, named EDR-Freeze and developed by researcher TwoSevenOneT, uses Windows Error Reporting to suspend security processes through a race condition attack. It operates entirely in user-mode, using legitimate Windows components rather than Bring Your Own Vulnerable Driver techniques.

The attack leverages the MiniDumpWriteDump function from Windows’ DbgHelp library to create memory snapshots of running processes and suspend the dumping process itself, leaving the target security solution frozen. The technique specifically targets WerFaultSecure.exe, a Windows Error Reporting component that can run with Protected Process Light privileges, and can be combined with CreateProcessAsPPL to bypass protection mechanisms.

In a practical test, EDR-Freeze was shown suspending Windows Defender’s MsMpEng.exe process on Windows 11 24H2 for a specified duration, with the tool accepting two parameters: the process ID of the target and the suspension duration. The researcher has made EDR-Freeze’s source code publicly available on GitHub, highlighting its relevance for legitimate security research and red team exercises, while raising concerns about potential misuse.