Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•4

Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques. This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.