PowerShell QoS Throttling Execution
This rule detects the use of PowerShell to create or modify Quality of Service (QoS) policies, specifically looking for the 'New-NetQosPolicy' cmdlet combined with parameters related to bandwidth throttling ('ThrottleRateActionBitsPerSecond') or application targeting ('AppPathNameMatchCondition'). This activity can be indicative of an attacker attempting to disrupt EDR agent connectivity by severely limiting network bandwidth, a technique associated with 'EDRChoker'.
Microsoft Sentinel (KQL)
