Detecting EDR-Freeze
NOTE: Big kudos to "Steven Lim @KQLWizard" as he developed the detection and i just adapted the extract regex. at my tests -p was not enough as the parameter was /pid is used. Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day. Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified. -- original description from @KQLWizard -- DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
Microsoft Sentinel (KQL)
