This detection rule targets the Windows defense-evasion technique commonly known as EDR-Freeze, where an attacker abuses WerFaultSecure.exe (Protected Process Light) to dump memory from a protected process and then suspends WerFaultSecure.exe to leave the target defense software (EDR/antivirus) in a frozen state without terminating it. The rule triggers on the start of WerFaultSecure.exe executed by a non-WER parent, combined with command-line indicators for a secure memory dump (examples include /pid and /encfile). Legitimate secure dumps are normally initiated by the WER service, so an abnormal parent process is a strong signal of abuse. The rule maps to MITRE ATT&CK T1562.001 (Disable or Modify Tools) under Defense Evasion and leverages telemetry from multiple endpoint data sources (e.g., Sysmon Process Creation, Elastic Endgame/Defend, SentinelOne Cloud Funnel, Microsoft Defender XDR, M365 Defender). It is designed to corroborate signals across data sources such as process creation events from multiple security telemetry streams and ED/EDX integrations. False positives are possible when legitimate crash-analysis or diagnostics tooling directly invokes WerFaultSecure.exe; in such cases, exceptions can be scoped to the specific parent executable and code signature. Triage guidance includes verifying parent process lineage, analyzing the targeted process, inspecting full command lines for /type and /encfile usage, and checking for process suspension indicators around the time of the event. Remediation steps emphasize isolating the host, restarting protection, preserving relevant artifacts, and investigating the initial access vectors and any lateral movement activity, with credential resets as appropriate and escalation to IR if a security control is involved.