The new EDR-Freeze tool uses Windows WER
New EDR-Freeze tool uses Windows WER to suspend security software A new method and proof-of-concept tool called EDR-Freeze demonstrates that evading security solutions is possible from user mode with Microsoft’s Windows Error Reporting (WER) system. The technique eliminates the need of a vulnerable driver and puts security agents like endpoint detection and response (EDR) tools into…