All Detections

Detecting EDR-Freeze

avatar
Steven Lim@KQLWizard
updated Sep 22, 2025245586,026

DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.

Microsoft Sentinel (KQL)