SIGNATURE_BASE_HKTL_EDR_Freeze_Sep25_2

rule SIGNATURE_BASE_HKTL_EDR_Freeze_Sep25_2 : FILE
{
	meta:
		description = "Detects EDR-Freeze hacktool"
		author = "Florian Roth"
		id = "e3fd5815-71c4-5510-bfb4-82203d81cc78"
		date = "2025-09-30"
		modified = "2026-05-15"
		reference = "https://github.com/TwoSevenOneT/EDR-Freeze"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/hktl_edr_freeze_sep25.yar#L1-L36"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "193ca17f574fa5e23866560170425f83696f78e83dabd7e831dd7827a69283fd"
		hash = "36a17919a97732f1ddc31b421c6ebb0c535924f895d7caaff04a5da908c42f76"
		hash = "394b768bfd3506a9ee6b7bbe6f87c40fb23c28f7919a2a9eb333b27db635eafe"
		hash = "a8ec07f006a9068ce5f068b3bb61b0649481b6b26203b8eb4308c53ff1d1bf8d"
		hash = "d485017fb20c5a8fe38a6dbf896d4cbce485ff53a6cfe0e1440a1818b2d303ee"
		hash = "d989ebd417e6fae60a544e43bfc0ee63f5d9352ce0059b95ed4e7e18efbc5d0b"
		hash = "e2b2dd0984e52112965392471f6a09020eb8380aa53d48d2fb4dd3aaa7edae9b"
		logic_hash = "735d56839f17ca98a0022e6044b8d0bc43201b48e3a64c7b671c417f62749643"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$x1 = "EDR-Freeze.exe <TargetPID> <SleepTime>" wide fullword
		$x2 = "Successfully created PPL process with PID:" wide fullword
		$x3 = "\\EDR-Freeze.pdb" ascii
		$sa1 = "C:\\Windows\\System32\\WerFaultSecure.exe" wide fullword
		$sa2 = "Failed to create dump files: " wide fullword
		$sb1 = " /encfile" wide fullword
		$sb2 = " /pid" wide fullword
		$sb3 = " /tid" wide fullword
		$sb4 = " /cancel" wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 1000KB and ( 1 of ( $x* ) or all of ( $sa* ) or all of ( $sb* ) ) or 6 of them
}