EDRChoker - QoS registry manipulation targeting EDR binaries
This detection identifies attempts to create or modify Windows Quality of Service (QoS) policy registry entries under: HKLM\SOFTWARE\Policies\Microsoft\Windows\QoS where the configured QoS policy references Microsoft Defender for Endpoint components, including SenseIR, MsSense, WinDefend, or MsMpEng. Such modifications may be indicative of the EDRChoker technique, which abuses Windows QoS policies to throttle network bandwidth or degrade communications associated with Endpoint Detection and Response (EDR) solutions, potentially impacting security monitoring and telemetry collection. The query captures registry modifications targeting these security-related binaries and provides visibility into the initiating user account, process, command line, and parent process responsible for the change. This activity should be validated to determine whether it was performed as part of legitimate system administration or represents an attempt to impair endpoint protection capabilities.
Microsoft Sentinel (KQL)
