TLDR Tech / InfoSec
QoS Policies
Windows QoS policies can cap outbound bandwidth for specific processes, ports, or protocols, and attackers with admin rights can point these policies at EDR agents to choke their telemetry to the vendor cloud, sometimes down to 8 bits per second so TLS handshakes fail and alerts never arrive. The idea is to create such policies via PowerShell and WMI, highlights the EDRChoker proof-of-concept that mass-creates throttling rules for common EDR processes, and then walks through defensive playbooks: auditing ActiveStore QoS entries with PowerShell cmdlets, enabling detailed PowerShell and WMI logging, watching for NetQosCim-related Event ID 5857, and monitoring both transient (memory) and persistent (registry) QoS policies.
Read the full story