Detecting EDR/AV Freeze
The attack uses WerFaultSecure.exe (Windows Error Reporting component) running with PPL (Protected Process Light) protection at the WinTCB level to call MiniDumpWriteDump on any process, bypassing PPL. It leverages the CREATE_SUSPENDED flag during process creation and uses OpenProcess with PROCESS_SUSPEND_RESUME to suspend/resume PPL processes.
Microsoft Sentinel (KQL)
