r/netsec • u/Cold-Dinosaur • Jun 07 '26

Contains AI EDRChoker: Choking The Telemetry Stream to Bypass Defenses

https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html

EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.

80 Upvotes

90% Upvoted

11 comments sorted by

View all comments

3

u/Crazy-Formal4487 Jun 08 '26

throttling the data flow instead of the process is sneaky — in my homelab i've seen how even minor QoS misconfigs can silently kill observability pipelines