A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service).
Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRChoker operates at a lower level in the Windows networking stack, throttling agent communications to effectively sever telemetry without generating typical detection artifacts.
EDRChoker Tool Abuses Windows QoS Policies
Modern EDR platforms depend heavily on persistent client–server communication to deliver telemetry, enforce policies, and enable remote response actions. When this communication channel is disrupted, the EDR agent’s effectiveness degrades significantly, often leaving endpoints partially blind.
Historically, attackers and red team operators have leveraged Windows Defender Firewall rules or direct WFP API calls such as FwpmFilterAdd0 to block outbound traffic from EDR processes.
However, these methods frequently leave detectable traces, including packet-drop or packet-block events, which are increasingly monitored by security products like Elastic Defend.
EDRChoker introduces a stealthier alternative by leveraging Windows quality of service policies to impose extreme bandwidth throttling on targeted processes, as reported by Zero Salarium.
Instead of outright blocking network traffic, the tool reduces the available bandwidth to as low as 8 bits per second, effectively rendering communication unusable. Even modest throttling, such as 1 KB/s, is sufficient to break modern encrypted connections.
A typical TLS handshake requires several kilobytes of data exchange, largely due to certificate chains and cryptographic negotiation. When bandwidth is constrained below this threshold, handshake operations exceed application timeout limits, resulting in repeated connection failures that mimic unstable network conditions rather than deliberate interference.
The underlying mechanism that enables this technique is the quality of service Packet Scheduler driver (pacer.sys), which operates at the Network Driver Interface Specification (NDIS) level.
This positions it closer to the network interface card than WFP, allowing it to enforce traffic shaping after higher-level filtering decisions have already been made. Because most EDR solutions focus their monitoring on higher layers such as WFP or application-level hooks, QoS-based throttling can bypass conventional detection logic.
EDRChoker automates this process by accepting a list of known EDR process names and applying individual quality of service policies to each. These policies are created using native Windows functionality via PowerShell or Group Policy, and they persist across system reboots.
Each rule is uniquely identified using randomized GUID-based naming, complicating detection and correlation efforts. In testing environments, including Elastic Defend deployments, affected agents reportedly lose connectivity with their management servers entirely, preventing log ingestion, alerting, and remote control.
The tool operates in two modes: an installation mode that applies throttling policies based on an input list, and a removal mode that deletes previously created quality of service rules.
This dual functionality allows operators to simulate both attack and cleanup phases in controlled environments. Notably, because the technique relies on legitimate administrative features, it requires elevated privileges, reinforcing the importance of privilege management in enterprise environments.
From a defensive perspective, this technique highlights a visibility gap regarding quality of service policy abuse. Security teams are advised to regularly audit the quality of service configurations, monitor PowerShell activity related to New-NetQosPolicy, and review Windows Event Logs for policy creation events.
Additionally, detecting pre-compromise indicators, such as privilege escalation or suspicious administrative actions, remains critical, as the attack depends on administrative access.
EDRChoker underscores a broader trend in adversarial tradecraft: shifting from overt blocking mechanisms to subtle degradation techniques that blend with normal system behavior.
By targeting the reliability of telemetry rather than its existence, attackers can create blind spots without triggering traditional alarms. As EDR solutions evolve, visibility into lower-level networking components like pacer.sys and quality of service enforcement may become essential to counter this emerging evasion vector.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
