CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

EDR-Freeze: Windows WER abuse suspends security software

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A new technique called EDR-Freeze exploits Windows Error Reporting (WER) to suspend endpoint detection and response (EDR) and antivirus software. The method uses the WER framework and MiniDumpWriteDump API to indefinitely suspend security processes from user mode. This technique is stealthier and avoids the need for vulnerable drivers, making it harder to detect and defend against. Security researcher TwoSevenOneThree (Zero Salarium) developed the proof-of-concept tool, demonstrating its effectiveness on Windows 11 24H2. The method leverages legitimate Windows components, making it a design weakness rather than a vulnerability. Defending against EDR-Freeze involves monitoring WER activity and restricting its use to specific processes.

Timeline

  1. 22.09.2025 20:07 1 articles · 7d ago

    EDR-Freeze tool suspends security software using Windows WER

    Security researcher TwoSevenOneThree (Zero Salarium) developed a proof-of-concept tool called EDR-Freeze. The tool suspends EDR and antivirus processes indefinitely by exploiting Windows Error Reporting (WER) and MiniDumpWriteDump API. The method operates from user mode, making it stealthier and harder to detect. It was successfully tested on Windows 11 24H2, freezing the Windows Defender process.

    Show sources
    Open in new tab

Information Snippets