All Detections

PowerShell New-NetQosPolicy Execution

avatar
Ibrahim Saud@tektrix
updated Jun 18, 20260010

Detects execution of New-NetQosPolicy in PowerShell, indicative of EDRChoker QoS throttling, which can be used to impair defenses.

Microsoft Sentinel (KQL)