EDR-Freeze: Novel Windows WER Technique Suspends EDR and Antivirus Tools
Executive Summary
In September 2025, a security researcher revealed a novel user-mode evasion technique leveraging Windows Error Reporting (WER) to suspend the operation of Endpoint Detection & Response (EDR) and antivirus software. The proof-of-concept tool, EDR-Freeze, exploits a race condition by combining the WerFaultSecure component with the MiniDumpWriteDump API. Attackers can indefinitely freeze security processes by suspending WerFaultSecure precisely as it is executing a memory dump of the target, effectively leaving EDR or AV tools inert without requiring kernel-level vulnerabilities. This design weakness bypasses typical Bring Your Own Vulnerable Driver (BYOVD) defences and leaves minimal forensic evidence.
This incident underscores the increasing sophistication of EDR evasion by cyber adversaries, who are rapidly adopting stealthy, native Windows attack chains. Organizations must adapt detection and monitoring practices to keep pace as user-mode bypasses erode longstanding layers of endpoint protection. The wider prevalence of such techniques signals a strategic shift in attacker tradecraft and compels a reassessment of endpoint hardening and response automation.
Why This Matters Now
EDR-Freeze exposes a critical blind spot in endpoint protection, enabling attackers to neutralize security software using only legitimate, built-in Windows components. As similar evasion tools proliferate and ransomware operators adopt these stealthy tactics, organizations face urgent pressure to upgrade their detection and hardening strategies before such exploits are mainstream in the wild.
Attack Path Analysis
The attacker first gained a foothold on a Windows host, likely exploiting weak access controls or social engineering. Without needing elevated kernel privileges, the attacker leveraged the legitimate WerFaultSecure and MiniDumpWriteDump APIs to suspend EDR processes via a stealthy user-mode technique. Once EDR was disabled, the adversary could laterally move within the environment or escalate their operations undetected. With EDR processes suspended, the attacker established persistent command and control without fear of being monitored. This positioned them to exfiltrate sensitive data or deploy secondary tools, potentially using encrypted or covert channels. Ultimately, the attack's impact was the loss of endpoint visibility and the opening of the environment to further compromise, ransomware, or persistent threat activity.
Kill Chain Progression
Initial Compromise
Description
Attacker obtained initial access to a Windows system, likely via phishing, exploitation of misconfiguration, or use of valid credentials.
Related CVEs
CVE-2025-XXXX
CVSS 7.8A vulnerability in Windows Error Reporting (WER) allows local attackers to suspend security processes, leading to potential security bypass.
Affected Products:
Microsoft Windows – 10, 11
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Impair Defenses
Impair Defenses: Disable or Modify Tools
Indirect Command Execution
Process Injection
Indicator Removal on Host
Signed Binary Proxy Execution
OS Credential Dumping
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Respond to Suspected Compromises
Control ID: 10.2.5
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management
Control ID: Art. 8
CISA ZTMM 2.0 – Monitoring and Analytics
Control ID: Detect & Respond: Security Analytics
NIS2 Directive – Incident Handling
Control ID: Art. 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical risk as EDR-Freeze tool can suspend endpoint security protecting sensitive financial data, enabling ransomware deployment and regulatory compliance violations.
Health Care / Life Sciences
High exposure to patient data breaches through EDR evasion attacks, compromising HIPAA compliance and enabling medical record theft or ransomware encryption.
Government Administration
Severe national security implications as attackers can disable government endpoint protection systems, facilitating espionage campaigns and critical infrastructure compromise.
Computer/Network Security
Direct impact on security vendors whose EDR products are targeted, requiring immediate defensive countermeasures and client notification of potential bypass techniques.
Sources
- New EDR-Freeze tool uses Windows WER to suspend security softwarehttps://www.bleepingcomputer.com/news/security/new-edr-freeze-tool-uses-windows-wer-to-suspend-security-software/Verified
- Inside EDR-Freeze: How ThreatDown stops the attack before it spreadshttps://www.threatdown.com/blog/inside-edr-freeze-how-threatdown-stops-the-attack-before-it-spreads/Verified
- EDR-Freeze: New Proof-of-Concept Attack Freezes Security Toolshttps://www.morphisec.com/blog/edr-freeze-attack-freezes-security-tool/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Zero Trust segmentation, east-west traffic security, and real-time threat detection provided by the Cloud Native Security Fabric would have constrained or detected lateral movement, enforced containment, and flagged suspicious abuse of privileged processes, even when endpoint agents were disabled.
Control: Zero Trust Segmentation
Mitigation: Minimizes attack surface and limits initial access scope.
Control: Threat Detection & Anomaly Response
Mitigation: Anomalous API invocations and suspensions of security processes can be detected and alerted.
Control: East-West Traffic Security
Mitigation: Lateral movement attempts are monitored, logged, and can be blocked across workloads and zones.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound communications to known or suspicious destinations are restricted and encrypted flows monitored.
Control: Encrypted Traffic (HPE)
Mitigation: Data in transit is encrypted, and unapproved exfiltration attempts are flagged.
Maintains distributed enforcement and residual visibility even if host-based security is disabled.
Impact at a Glance
Affected Business Functions
- Security Monitoring
- Incident Response
Estimated downtime: 1 days
Estimated loss: $50,000
Potential unauthorized access to sensitive data during the period when security processes are suspended.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce network-level zero trust segmentation to compartmentalize sensitive assets and reduce attack propagation.
- • Deploy continuous east-west traffic monitoring and microsegmentation to detect and prevent unauthorized lateral movement, even if EDR is bypassed.
- • Use centralized threat detection and anomaly response systems that baseline normal process and API activity for early alerting.
- • Implement strict egress controls with FQDN filtering and encrypted traffic inspection to block C2 and exfiltration attempts from compromised hosts.
- • Leverage cloud-native, inline network security fabrics to retain posture and observability in the face of endpoint agent evasion techniques.
