EDR Blinding via QoS Bandwidth Throttling
detects creation of QoS throttle policies in HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS\ with ThrottleRate value. pacer.sys enforces these policies at the NDIS layer below WFP, throttling EDR agent bandwidth to near-zero and causing telemetry upload timeouts.
Cortex XDR
