Darvox
@Darvox3 followers13 downloads29 copies8 likes1,358 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
NOTE: Big kudos to "Steven Lim @KQLWizard" as he developed the detection and i just adapted the extract regex. at my tests -p was not enough as the parameter was /pid is used.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
Changed timestamps into one variable as i do not see the need for a bigger lookback (e.g. 30d) if i just check for the process ids of a day.
Tested with https://github.com/TwoSevenOneT/EDR-Freeze, tests was not successfull as Files could not be suspended. Reason not verified.
-- original description from @KQLWizard --
DR-Freeze abuses WerFaultSecure.exe to suspend AV/EDR via MiniDumpWriteDump — no BYOVD needed.
NOTE: big kudos to "F S"@Fsdr, as i mainly took his query. Just saw a little error at the risk level association while testing. Must be looking for InitiatingProcessFolderPath as it contains complete path and InitiatingProcessFileName just the FileName (without path).
Tested with https://github.com/TwoSevenOneT/WSASS
-- original description from @fsdr --
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
Tested with https://github.com/TwoSevenOneT/WSASS
-- original description from @fsdr --
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.