QoS Policy Targeting EDR Process
Detects the creation of Quality of Service (QoS) policies via PowerShell that explicitly target known Endpoint Detection and Response (EDR) agent executables. This activity could indicate an adversary attempting to degrade or block EDR telemetry to evade detection.
Microsoft Sentinel (KQL)
