Malicious Execution of Hacktool - EDR-Freeze (via process_creation)

This rule detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze abuses a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This method does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.