EDR-Freeze: How a Researcher Turned Windows Error Reporting Into a Weapon Against Antivirus

A ZeroSalarium security researcher has demonstrated a new technique to bypass endpoint protections by abusing Windows Error Reporting, rather than the BYOVD driver route, to suspend antivirus and EDR processes from user space.

According to the study, the approach combines WerFaultSecure with CreateProcessAsPPL to bypass Protected Process Light restrictions and trigger MiniDumpWriteDump on security processes, effectively freezing them by suspending all threads during the dump and then pausing WerFaultSecure at the right moment.

The researchers details a race-condition attack: launch WerFaultSecure with PPL privileges against an antivirus process, suspend the target, then suspend WerFaultSecure itself so the target remains indefinitely paused. They also developed EDR-Freeze, a tool that, according to the documentation, takes the PID of the target and a pause duration to force the process to stop.

In testing, MsMpEng.exe, the core Windows Defender process, was suspended for 5000 milliseconds on Windows 11 24H2, providing attackers with a brief window to operate undetected. The study notes that there is no kernel code involved, and the technique leverages trusted Windows binaries, making detection harder.