TLDR Tech / InfoSec
EDRUnChoker (GitHub Repo)
EDRUnChoker is a fileless WMI-based defensive tool that counters EDRChoker's QoS abuse by registering a permanent root\subscription event subscription that runs a 5-second VBScript timer to enumerate and remove malicious New-NetQosPolicy throttles targeting known EDR agent processes via WbemContext PolicyStore on both ActiveStore and GPO:localhost, logging each removed policy as Event ID 1002 under source EDRChokerDefense in the Application log.
Read the full story