PowerShell ThrottleRateActionBitsPerSecond < 1MB

Ibrahim Saud@tektrix

•updated Jun 18, 2026•0•0•4

Detects QoS policy creation with a throttle rate applied, targeting EDR disconnection via extreme low bandwidth. This rule specifically looks for PowerShell commands that include 'ThrottleRateActionBitsPerSecond' in their additional fields, indicating an attempt to set a very low bandwidth throttle.