new: EDRChoker QoS ThrottleRate Set by WMI

rules/windows/registry/registry_event/registry_event_wmi_qos_throttlerate.yml

@@ -0,0 +1,24 @@
+title: QoS ThrottleRate Set by WMI
+id: e4b2d9a1-8f3a-4c9b-9e2a-1d7f6b5a3c21
+status: experimental
+description: Detects when a QoS with ThrottleRate policy is created by Windows Management Instrumentation provider service. This behavior is an indication of EDR suppression where an attacker severs the communication between the agent and the management server for telemetry and alerting.
+author: Tamseel Ahmad
+references:
+  - https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html
+date: 2026-06-12
+tags:
+  - attack.defense_evasion
+  - attack.t1562.001
+logsource:
+  product: windows
+  category: registry_event
+detection:
+  selection:
+    Image|endswith: '\wmiprvse.exe'
+    TargetObject|contains|all:
+      - '\QoS\'
+      - 'ThrottleRate'
+  condition: selection
+falsepositives:
+  - Legitimate uses of QoS policies
+level: medium