Multiple QoS Policies Created Quickly

Ibrahim Saud@tektrix

•updated Jun 18, 2026•2•0•11

Identifies rapid creation of multiple QoS policies, matching EDRChoker's behavior iterating through process lists. This rule detects when three or more QoS policies are created within a one-minute window on a single device, indicated by the execution of 'New-NetQosPolicy' via PowerShell.