mirror of
https://github.com/TwoSevenOneT/EDRChoker
synced 2026-06-08 15:47:19 +00:00
Two Seven One Three
1.2 KiB
1.2 KiB
EDRChoker
EDRChoker uses Policy-based Quality of Service (QoS) to set hard bandwidth caps (throttling) on Endpoint Detection and Response (EDR) agents, causing them to always time out - effectively blocking them.
The rules take effect immediately and persist after the target reboots Windows.
EDRChoker relies on Windows' pacer.sys driver.
Command Line Syntax
EDRChoker.exe <ListFile>
To create QoS Policy for all process name in ListFile - Each line per process
EDRChoker.exe
To remove all installed QoS Policy
Links
EDRChoker: Choking The Telemetry Stream to Bypass Defenses
Some EDR/Antivirus have been successfully tested
- Elastic Defend
- ...
- Please contact me if you successfully test it against any other EDR.
Demo Video
Youtube EDR-Redir V1: https://www.youtube.com/watch?v=2_tanx7RSUw
