// Based on EDR-freeze proof of concept seen here: https://www.bleepingcomputer.com/news/security/new-edr-freeze-tool-uses-windows-wer-to-suspend-security-software/
let SuspiciousProcessCalls = pack_array(
    "MsMpEng.exe",
    "lsass.exe");
DeviceFileEvents
| where InitiatingProcessFileName == "werfaultsecure.exe"
    and FileName in~ (SuspiciousProcessCalls)
or InitiatingProcessParentFileName == "werfaultsecure.exe"
    and InitiatingProcessFileName in~ (SuspiciousProcessCalls)
| distinct ActionType, FileName, InitiatingProcessFileName, InitiatingProcessParentFileName