EDRChoker Uses Windows QoS to Throttle EDR Telemetry and Force Timeouts
EDRChoker exploits Windows' policy‑based Quality of Service to impose hard outbound bandwidth caps on Endpoint Detection and Response agents, causing their telemetry streams to time out and effectively disabling the agents. The technique avoids firewall or WFP rules, offering a stealthier evasion path for red teams.