EDR Freeze WerfaultSecure Abuse

Tim Peck@timpeck

•updated Sep 22, 2025•4•2•725

Detects the execution of WerFaultSecure.exe with command-line parameters used to target and dump a specific process. This technique is used by tools like EDR-Freeze to suspend EDR and Antivirus processes by abusing the MiniDumpWriteDump function.