Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze (via process_access)

This rule detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, suggesting potential EDR freeze techniques. This method abuses WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing hostile behavior to execute undetected during the suspension period.