Ethical Hacking News
A recently discovered vulnerability in Windows Error Reporting (WER) allows for the suspension of security software using a new tool called EDR-Freeze. This technique leverages legitimate components of the operating system to bypass traditional approaches that require exploiting kernel drivers.
The new vulnerability EDR-Freeze exploits a Windows Error Reporting (WER) feature to suspend security software. The technique uses the MiniDumpWriteDump API and is more stealthy than existing methods that require exploiting legitimate kernel drivers. EDR-Freeze operates entirely from user mode, making it a subtle approach without requiring kernel-level modifications or interactions with the system. A race condition attack allows an attacker to freeze security software by suspending the WerFaultSecure process before completing the dump operation. Microsoft could address this vulnerability by hardening its Windows components against abuse, such as blocking suspicious invocation or restricting parameters. To defend against EDR-Freeze, monitoring WER points and using tools like one developed by Steven Lim can aid in detection and prevention.
The security landscape is ever-evolving, with new threats and vulnerabilities emerging on a daily basis. One such vulnerability that has recently been exposed is related to the way Windows Error Reporting (WER) works, specifically its ability to suspend security software. In an article published by Bill Toulas of BleepingComputer, it has been revealed that a new method and proof-of-concept tool called EDR-Freeze takes advantage of this vulnerability to suspend security agents like endpoint detection and response (EDR) tools indefinitely.
The technique behind EDR-Freeze relies on the WER framework in conjunction with the MiniDumpWriteDump API. Security researcher TwoSevenOneThree, also known as Zero Salarium, discovered a way to use these components together to put security agents into a state of hibernation without needing a vulnerable driver. This approach is significantly more stealthy compared to existing EDR disabling methods, which require exploiting legitimate kernel drivers to gain privilege escalation.
The "Bring Your Own Vulnerable Driver" (BYOVD) technique has been around for some time and involves using a compromised kernel driver to bypass execution protections and remove kernel-level artifacts that could potentially expose the operation. However, this method comes with significant drawbacks. For instance, it necessitates smuggling the driver onto the target system, which can be challenging.
On the other hand, EDR-Freeze operates entirely from user mode and leverages legitimate Windows components present by default in the operating system. This makes it a much more subtle approach that doesn't require any kernel-level modifications or interactions with the user's system.
According to Zero Salarium, the method is based on leveraging the WerFaultSecure component of WER, which runs under Protected Process Light (PPL) privileges and collects crash dumps for debugging purposes. When this process calls MiniDumpWriteDump, it temporarily suspends all threads in the target process while writing the dump. The researcher also discovered a race condition attack where the attacker can suspend the WerFaultSecure process itself before completing the dump operation, effectively freezing the security software.
The steps to replicate this attack are as follows: spawn WerFaultSecure under PPL privileges; pass arguments that call MiniDumpWriteDump on the target PID; wait until the process becomes suspended by the dump operation; and then immediately open WerFaultSecure (PROCESS_SUSPEND_RESUME) and call NtSuspendProcess to freeze the dumper. Zero Salarium even published a tool that performs these actions, successfully freezing Windows Defender on a test system running Windows 11 24H2.
Microsoft could potentially address this vulnerability by hardening its Windows components against abuse. Measures such as blocking suspicious invocation or restricting parameters could provide an added layer of security.
To defend against EDR-Freeze, security researchers have proposed monitoring WER points to identify sensitive processes like LSASS or security tools. Furthermore, a tool developed by Steven Lim maps WerFaultSecure to Microsoft Defender Endpoint processes, aiding in the detection and prevention of such attacks.
In conclusion, this new EDR-Freeze method highlights the importance of vigilance in keeping up with emerging security threats and vulnerabilities in modern operating systems. As security landscapes continue to evolve, users and organizations must remain informed about potential risks and implement effective countermeasures to safeguard their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/New-EDR-Freeze-Tool-Exposes-Vulnerability-in-Windows-Security-Software-ehn.shtml
https://www.bleepingcomputer.com/news/security/new-edr-freeze-tool-uses-windows-wer-to-suspend-security-software/
https://infosecbulletin.com/edr-freeze-a-tool-that-puts-edrs-and-antivirus-into-a-coma-state/
Published: Mon Sep 22 13:31:49 2025 by llama3.2 3B Q4_K_M
