rule win_edr_freeze_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.edr_freeze."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.edr_freeze"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4c8bf9 e8???????? 4c8be8 488d4dcf e8???????? 0f1000 0f1145ff }
            // n = 7, score = 100
            //   4c8bf9               | lea                 ecx, [0x249b7]
            //   e8????????           |                     
            //   4c8be8               | and                 eax, 0x3f
            //   488d4dcf             | dec                 ebp
            //   e8????????           |                     
            //   0f1000               | mov                 esp, ebp
            //   0f1145ff             | dec                 ecx

        $sequence_1 = { 8d4805 e8???????? 488b05???????? 4885c0 751d 4c8d0d2a810100 4c8d051b810100 }
            // n = 7, score = 100
            //   8d4805               | dec                 eax
            //   e8????????           |                     
            //   488b05????????       |                     
            //   4885c0               | lea                 edx, [0x180f0]
            //   751d                 | lea                 ecx, [eax + 0x12]
            //   4c8d0d2a810100       | dec                 eax
            //   4c8d051b810100       | test                eax, eax

        $sequence_2 = { 66c1e002 8d0c10 6603c9 66442bc1 664183c030 66458902 448bc2 }
            // n = 7, score = 100
            //   66c1e002             | cmp                 byte ptr [edx + 0x38], 0
            //   8d0c10               | jge                 0xcb
            //   6603c9               | dec                 eax
            //   66442bc1             | mov                 edx, edi
            //   664183c030           | movzx               ecx, bp
            //   66458902             | dec                 ecx
            //   448bc2               | add                 ecx, eax

        $sequence_3 = { 415c 5f 5e c3 f6c204 7409 488d1d43900200 }
            // n = 7, score = 100
            //   415c                 | dec                 eax
            //   5f                   | cmp                 edx, 7
            //   5e                   | jbe                 0x89
            //   c3                   | movdqu              xmmword ptr [ebp + 0x90], xmm0
            //   f6c204               | mov                 word ptr [ebp + 0x80], di
            //   7409                 | dec                 eax
            //   488d1d43900200       | mov                 edx, dword ptr [ebp + 0xb8]

        $sequence_4 = { 4c897daf c645b700 4c897dbf c645c700 4c897dcf 6644897dd7 }
            // n = 6, score = 100
            //   4c897daf             | dec                 eax
            //   c645b700             | mov                 eax, dword ptr [esp + 0x28]
            //   4c897dbf             | dec                 eax
            //   c645c700             | lea                 eax, [esp + 0x28]
            //   4c897dcf             | dec                 eax
            //   6644897dd7           | add                 eax, 8

        $sequence_5 = { 8b4c2434 4c8d05102afdff b8cdcccccc f7e1 c1ea03 }
            // n = 5, score = 100
            //   8b4c2434             | dec                 ecx
            //   4c8d05102afdff       | cmovne              ebx, eax
            //   b8cdcccccc           | dec                 ebp
            //   f7e1                 | test                eax, eax
            //   c1ea03               | jle                 0x17ac

        $sequence_6 = { 488b4c3148 488b01 4d8bc7 498bd5 ff5048 493bc7 7410 }
            // n = 7, score = 100
            //   488b4c3148           | arpl                cx, cx
            //   488b01               | dec                 eax
            //   4d8bc7               | lea                 edx, [0x1ccf8]
            //   498bd5               | dec                 eax
            //   ff5048               | mov                 eax, ecx
            //   493bc7               | and                 ecx, 0x3f
            //   7410                 | dec                 eax

        $sequence_7 = { 4903f5 458be6 4c8b6dc7 e9???????? 4c8d1ddda5fdff 4f8b84eb20ab0400 }
            // n = 6, score = 100
            //   4903f5               | dec                 eax
            //   458be6               | lea                 esi, [ecx + 8]
            //   4c8b6dc7             | xor                 eax, eax
            //   e9????????           |                     
            //   4c8d1ddda5fdff       | dec                 eax
            //   4f8b84eb20ab0400     | mov                 dword ptr [esi], eax

        $sequence_8 = { 488d0df9820200 e8???????? 90 e8???????? cc e8???????? cc }
            // n = 7, score = 100
            //   488d0df9820200       | dec                 eax
            //   e8????????           |                     
            //   90                   | arpl                word ptr [eax + 4], cx
            //   e8????????           |                     
            //   cc                   | dec                 esp
            //   e8????????           |                     
            //   cc                   | lea                 eax, [0x1794e]

        $sequence_9 = { 4d8be9 4c8907 48890e 488b17 493bd1 0f84aa000000 483b8c24a0000000 }
            // n = 7, score = 100
            //   4d8be9               | lea                 ecx, [ebp - 0x59]
            //   4c8907               | nop                 
            //   48890e               | mov                 edi, 1
            //   488b17               | inc                 esp
            //   493bd1               | mov                 dword ptr [ebx + 8], edi
            //   0f84aa000000         | dec                 eax
            //   483b8c24a0000000     | lea                 eax, [0x2e5d9]

    condition:
        7 of them and filesize < 661504
}