EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools

Gbhackers •Divya • June 8, 2026

A newly disclosed red-team tool dubbed “EDRChoker” is drawing attention across the cybersecurity community for its novel approach to disrupting Endpoint Detection and Response (EDR) visibility by abusing Windows Policy-based Quality of Service (quality of service). Unlike traditional EDR evasion techniques that rely on firewall manipulation or Windows Filtering Platform (WFP) rule injection, EDRChoker operates […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EDRChoker Tool Disrupts Endpoint Detection Using Windows QoS Policies The EDRChoker tool, recently released as an open-source red team utility, disrupts Endpoint Detection and Response (EDR) systems by manipulating Windows' Policy-Based Quality of Service (QoS) settings. This innovative method reduces network bandwidth to near-zero, effectively silencing EDR agents without traditional evasion techniques like process termination or code injection. Developed by security researcher @TwoSevenOneT, EDRChoker poses a significant threat to organizations relying on cloud-connected EDR solutions. The tool's unique approach is gaining attention in the cybersecurity community, highlighting the need for enhanced defenses against such tactics. Currently, there are no specific CVEs associated with this tool, but its implications for endpoint security are considerable. 2 sources 49

EDRChoker Tool Abuses Windows QoS Policies to Disrupt Endpoint Security Tools

The full story

Extracted Entities

Platforms (1)

Tools (1)