Detects EDR-Freeze hacktool

Hunt Hypothesis

This hunt hypothesis targets adversaries deploying the EDR-Freeze tool to disable endpoint security agents and evade detection during active attacks. Proactively hunting for this behavior in Azure Sentinel is essential because freezing EDR processes creates a significant blind spot that allows attackers to execute malicious payloads undetected, necessitating immediate investigation of critical alerts.

YARA Rule

rule HKTL_EDR_Freeze_Sep25_2 {
   meta:
      description = "Detects EDR-Freeze hacktool"
      author = "Florian Roth"
      reference = "https://github.com/TwoSevenOneT/EDR-Freeze"
      date = "2025-09-30"
      score = 80
      hash1 = "193ca17f574fa5e23866560170425f83696f78e83dabd7e831dd7827a69283fd"
      hash2 = "36a17919a97732f1ddc31b421c6ebb0c535924f895d7caaff04a5da908c42f76"
      hash3 = "394b768bfd3506a9ee6b7bbe6f87c40fb23c28f7919a2a9eb333b27db635eafe"
      hash4 = "a8ec07f006a9068ce5f068b3bb61b0649481b6b26203b8eb4308c53ff1d1bf8d"
      hash5 = "d485017fb20c5a8fe38a6dbf896d4cbce485ff53a6cfe0e1440a1818b2d303ee"
      hash6 = "d989ebd417e6fae60a544e43bfc0ee63f5d9352ce0059b95ed4e7e18efbc5d0b"
      hash7 = "e2b2dd0984e52112965392471f6a09020eb8380aa53d48d2fb4dd3aaa7edae9b"
      id = "e3fd5815-71c4-5510-bfb4-82203d81cc78"
   strings:
      $x1 = "EDR-Freeze.exe <TargetPID> <SleepTime>" wide fullword
      $x2 = "Successfully created PPL process with PID:" wide fullword
      $x3 = "\\EDR-Freeze.pdb" ascii

      $sa1 = "C:\\Windows\\System32\\WerFaultSecure.exe" wide fullword  /* String occurs 2 times in goodware */
      $sa2 = "Failed to create dump files: " wide fullword

      $sb1 = " /encfile" wide fullword
      $sb2 = " /pid" wide fullword
      $sb3 = " /tid" wide fullword
      $sb4 = " /cancel" wide fullword
   condition:
      uint16(0) == 0x5a4d
      and filesize < 1000KB
      and (
         1 of ($x*)
         or all of ($sa*)
         or all of ($sb*)
      ) or 6 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the Detects EDR-Freeze hacktool detection rule, including suggested filters and exclusions:

Scenario: Automated Endpoint Security Health Checks
- Context: The enterprise’s primary EDR solution (e.g., CrowdStrike Falcon or Microsoft Defender for Endpoint) runs a scheduled “Health Check” job every morning at 02:00 UTC. This process injects the EDR-Freeze utility to temporarily pause real-time scanning agents on critical servers before applying large patches, mimicking the behavior of an attacker freezing EDR services.
- Filter/Exclusion: Create a whitelist exclusion based on the specific Process Name (falconhealthcheck.exe) and Parent Process (TaskScheduler.exe). Additionally, exclude detections occurring strictly within the time window of 01:30 UTC to 02:30 UTC.
Scenario: Third-Party Backup Agent Initialization
- Context: The organization uses Veeam Backup & Replication for nightly backups. During initialization on high-I/O storage servers, the Veeam agent (VeeamAgent.exe) launches a helper process that utilizes the EDR-Freeze tool to prevent backup I/O contention with active real-time scanning engines.
- Filter/Exclusion: Implement an exclusion rule targeting the User Account SYSTEM or specific service accounts (e.g., DOMAIN\VeeamSvc) when the executable path matches C:\Program Files\VEEAM\Backup and Replication\Agent\.
Scenario: Patch Management Deployment via SCCM/Intune
- Context: During a scheduled Windows Update deployment, the System Center Configuration Manager (SCCM) or Microsoft Intune agent executes a pre-installation script. This script invokes EDR-Freeze to lock down security agents on