Executive Summary
A new technique and tool named EDRChoker have been identified that bypass Endpoint Detection and Response (EDR) telemetry by utilizing Policy-based Quality of Service (QoS) throttling. Unlike traditional methods that use the Windows Filtering Platform (WFP) or Windows Firewall, EDRChoker operates via the pacer.sys driver at the NDIS layer. By restricting an EDR agent's outbound bandwidth to as little as 8 bits per second, the tool causes persistent TLS handshake timeouts and connection drops, rendering the security agent unable to transmit logs or receive commands.
Technically, the tool leverages WMI to create new instances of MSFT_NetQosPolicySettingData within the ROOT\StandardCimv2 namespace. Because these policies operate at Layer 5 (NDIS), they sit below the WFP layer where many security products monitor for network interference. This approach allows an attacker with administrative privileges to silently neutralize defenses without triggering the common "packet-drop" alerts associated with firewall-based tampering.
This technique is highly effective against cloud-reliant security agents, such as Elastic Defend, which lose all operational utility when connectivity is severed. Furthermore, these QoS policies are persistent across system reboots, posing a long-term threat to visibility and response capabilities within a compromised environment.