EDR Agent Heartbeat Timeout Anomaly
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
Microsoft Sentinel (KQL)
