detection.wiki

Detection rules › Sigma

Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze

Status
experimental
Severity
high
Log source
product windows, category process_access
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques. This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentT1685 Disable or Modify Tools

Event coverage

ProviderEventTitle
SysmonEvent ID 10ProcessAccess

Rule body yaml

title: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
related:
    - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
      type: similar
    - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
      type: similar
status: experimental
description: |
    Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.
    This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.
references:
    - https://blog.axelarator.net/hunting-for-edr-freeze/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-27
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_access
    product: windows
    definition: |
        Requires Sysmon Event ID 10 (ProcessAccess) with CallTrace enabled.
        Example sysmon config snippet with grouping, as logging individual ProcessAccess events can generate excessive logs:
        <ProcessAccess onmatch="include">
            <Rule groupRelation="and">
            <TargetImage condition="end with">\MsMpEng.exe</TargetImage>
            <SourceImage condition="end with">\WerFaultSecure.exe</SourceImage>
            </Rule>
        </ProcessAccess>
detection:
    selection:
        SourceImage|endswith: '\WerFaultSecure.exe'
        TargetImage|endswith: '\MsMpEng.exe'
        CallTrace|contains:
            - '\dbgcore.dll'
            - '\dbghelp.dll'
    condition: selection
falsepositives:
    - Legitimate Windows Error Reporting operations
level: high
regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access/info.yml

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    SourceImage|endswith: '\WerFaultSecure.exe'
    TargetImage|endswith: '\MsMpEng.exe'
    CallTrace|contains:
        - '\dbgcore.dll'
        - '\dbghelp.dll'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CallTracematch
  • \dbgcore.dll
  • \dbghelp.dll
SourceImageends_with
  • \WerFaultSecure.exe corpus 4 (sigma 4)
TargetImageends_with
  • \MsMpEng.exe