Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 24-Sep-2025 06:48:51 JST Kevin Beaumont

   Microsoft need to run this blog as a SSIRP process with Windows engineers and Defender.

   Opinions will vary but I think this needs a fix in base OS. This will 100% lead to more ransomware incidents.

   I’ve trued EDR Freeze and it’s a straight up tamper protection bypass.

   https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html

   • Embed this notice
     Brian Clark (deepthoughts10@infosec.exchange)'s status on Wednesday, 24-Sep-2025 07:29:12 JST Brian Clark

     in reply to

     @GossiTheDog Steven Lim has written a Microsoft KQL detection for EDR Freeze and made it available here:

     https://detections.ai/share/rule/cicyA1JW

   • Embed this notice
     fuzzyfuzzyfungus (fuzzyfuzzyfungus@cyberplace.social)'s status on Wednesday, 24-Sep-2025 07:44:57 JST fuzzyfuzzyfungus

     in reply to

     @GossiTheDog How dire are the consequences of denying WerFaultSecure with a WDAC policy?

     It's not hugely common in practice, but if you go to sufficient effort or are blessed with deeply homogeneous hardware you can (unless you depend on the vulnerable drivers) WDAC attempts to just pull random dodgy drivers in; but I'm not sure how badly the OS takes it if an expected component is forbidden to execute.

   • Embed this notice
     James Forshaw :donor: (tiraniddo@infosec.exchange)'s status on Wednesday, 24-Sep-2025 16:29:52 JST James Forshaw :donor:

     in reply to

     @GossiTheDog creative for sure, but I wonder if there's not other places that could force a process to suspend at least if you already have admin access. Ultimately EDR lives and dies by it's ability to catch the malware before it disables the EDR. Not sure how MS would fix this in the OS.