specialized crash-analysis, debugging, or diagnostics tooling that invokes werfaultsecure.exe directly to capture a secure process dump. validate the parent process, its code signature, and the targeted process before adding an exception.

Techniques

T1562

Sample rules

Potential EDR-Freeze via WerFaultSecure Abuse

source: elastic
technicques:
- T1562

Description

Identifies the Windows Error Reporting Protected Process Light (PPL) binary WerFaultSecure.exe being started by a process other than the Windows Error Reporting service, with command-line arguments used to take a secure memory dump of a target process. Because MiniDumpWriteDump suspends all threads of the target while the dump is produced, an attacker can suspend WerFaultSecure.exe mid-dump to leave the targeted EDR or antivirus suspended (“frozen”) without ever terminating it, a defense-evasion technique publicly known as EDR-Freeze.

Detection logic

process where host.os.type == "windows" and event.type == "start" and
  process.executable : "?:\\Windows\\System32\\WerFaultSecure.exe" and

  /* WerFaultSecure secure dumps are normally initiated by the WER service hosted in svchost.exe */
  process.parent.executable != null and
  not process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\wermgr.exe", "?:\\Windows\\System32\\WerFault.exe", "?:\\Windows\\System32\\WerFaultSecure.exe") and

  /* arguments used to take a secure memory dump of a target process (e.g. /pid <target> /encfile <handle> /type 268310) */
  process.args : "/pid" and process.args : "/encfile"