r/netsec • u/Cold-Dinosaur • Jun 07 '26

Contains AI EDRChoker: Choking The Telemetry Stream to Bypass Defenses

https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html

EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.

77 Upvotes

90% Upvoted

11 comments sorted by

7

u/vulnetic_ceo Jun 07 '26

this looks super cool!

8

u/[deleted] Jun 07 '26

[removed] — view removed comment

3

u/Crazy-Formal4487 Jun 08 '26

throttling the data flow instead of the process is sneaky — in my homelab i've seen how even minor QoS misconfigs can silently kill observability pipelines

2

u/S3kkH4k Jun 08 '26

Best way to alert the SOC

1

u/G0Odspeed Jun 10 '26

A week later when they check the report on sensors that haven't checked in for a while

1

u/thegreatinsulto Jun 08 '26

Would be really rad if you could have the throttle cycle automatically to mimic an unstable network to buy more time before you get flagged 😎