🥶 Freeze

Freeze.rs is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze.rs utilizes multiple techniques to not only remove Userland EDR hooks, but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls.

Research:
https://www.optiv.com/insights/source-zero/blog/sacrificing-suspended-processes

Source:
https://github.com/optiv/Freeze.rs

#av #edr #etw #windows #maldev