WMI MSFT_NetQosPolicySettingData Creation
Detects WMI interaction creating a new QoS policy instance, potentially bypassing standard PowerShell logging. This can be used by adversaries to throttle network traffic.
Microsoft Sentinel (KQL)
Detects WMI interaction creating a new QoS policy instance, potentially bypassing standard PowerShell logging. This can be used by adversaries to throttle network traffic.
Already have an account?