Suspicious Process Suspension via WerFaultSecure.exe (EDR-Freeze)
Detects attempts to freeze a process, likely an EDR or an antimalware service process, through EDR-Freeze that abuses the WerFaultSecure.exe process to suspend security software. The rule specifically looks for WerFaultSecure.exe being executed with a particular set of command-line arguments that are indicative of the EDR-Freeze tool's behavior, including '/h', '/pid', '/tid', '/encfile', '/cancel', '/type', and '268310'.
Sigma
