LINDENSEC

QoS policies are a legitimate bandwidth management feature. Point New-NetQosPolicy at a security tool and cap it to near zero, and the process keeps running, no tamper alert fires, but it can no longer reach the cloud. This is what EDRChoker does as a compiled tool, and Defender catches that binary now, yay! Now let me explain in my blog why that means absolutely nothing.