EDR-Freeze/EDR-Sleep
Detects potential abuse of LOLBAS techniques (e.g., WerFaultSecure.exe, rundll32.exe, comsvcs.dll) associated with EDR-Freeze attacks. These attacks suspend EDR or AV processes by exploiting Windows Error Reporting to create a race condition, leaving the system unmonitored. The rule triggers when a known LOLBAS executable is run and the device stops reporting telemetry, with no legitimate shutdown or logoff activity recorded, suggesting the endpoint security agent may have been suspended.
Microsoft Sentinel (KQL)
