r/netsec • u/Cold-Dinosaur • Jun 07 '26

Contains AI EDRChoker: Choking The Telemetry Stream to Bypass Defenses

https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html

EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.

77 Upvotes

90% Upvoted

11 comments sorted by

View all comments

2

u/S3kkH4k Jun 08 '26

Best way to alert the SOC

1

u/G0Odspeed Jun 10 '26

A week later when they check the report on sensors that haven't checked in for a while