twosevenonet/edrchokerA tool uses the QoS Policy (Pacer.sys) to throttle Endpoint Detection and Response (EDR) agents from connecting to the server.
EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.
The rules take effect immediately and persist after the target reboots Windows.
EDRChoker relies on Windows' pacer.sys driver.
EDRChoker.exe <ListFile>
To create QoS Policy for all process name in ListFile - Each line per process
EDRChoker.exe
To remove all installed QoS Policy
EDRChoker: Choking The Telemetry Stream to Bypass Defenses
Youtube EDRChoker: https://youtu.be/hj05mT-45bo
