EDRChoker Tool Execution
Detects execution of the EDRChoker utility, a tool designed to degrade cloud-connected EDR performance by applying aggressive network throttling policies. Successful use of this tool may reduce endpoint visibility, delay security alerts, and hinder incident response efforts.
Microsoft Sentinel (KQL)
