EDRChoker list.txt Execution
Detects execution of EDRChoker, a tool designed to impair EDR telemetry, when it is passed a process list text file as an argument. The rule specifically looks for command lines containing 'list.txt', an executable name (e.g., 'tool.exe'), and the string 'edr'.
Microsoft Sentinel (KQL)
