Get-NetQosPolicy Auditing

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•5

Detects enumeration of existing QoS policies via PowerShell, potentially used by attackers to verify throttling. This rule specifically looks for the execution of the 'Get-NetQosPolicy' command within PowerShell.