mirror of
https://github.com/sbousseaden/EDRUnChoker
synced 2026-06-21 14:09:16 +00:00
sbousseaden
65 lines
3.0 KiB
Markdown
65 lines
3.0 KiB
Markdown
# EDRUnChoker
|
|
|
|
**Fileless WMI remediation for [EDRChoker](https://github.com/TwoSevenOneT/EDRChoker)** counters QoS abuse (`pacer.sys`) that throttles EDR agents to near-zero network bandwidth.
|
|
|
|
Registers a permanent subscription in `root\subscription` (no files on disk). A 5-second timer runs embedded VBScript that enumerates QoS policies with **WbemContext `PolicyStore`** on **ActiveStore** and **GPO:localhost** — plain WMI `ExecQuery` misses ActiveStore policies created by `New-NetQosPolicy` / EDRChoker — and removes malicious app-path throttles targeting known security products or aggressive rates (≤ 1 Mbps).
|
|
|
|
## Scripts
|
|
|
|
| Script | Purpose |
|
|
|---|---|
|
|
| `Install-EdrChokerWmiDefense.ps1` | Deploy subscription (elevated) |
|
|
| `Uninstall-EdrChokerWmiDefense.ps1` | Remove subscription |
|
|
| `Get-EdrChokerDefenseStatus.ps1` | Check subscription and policy count |
|
|
|
|
## Quick start
|
|
|
|
```powershell
|
|
.\Install-EdrChokerWmiDefense.ps1
|
|
.\Get-EdrChokerDefenseStatus.ps1
|
|
```
|
|
|
|
## SOC / event log
|
|
|
|
Each successful cleanup writes a **Warning** to the **Application** log under source **EDRChokerDefense**. One event is emitted per removed policy, useful as remediation evidence and to correlate with EDRChoker activity on the host.
|
|
|
|
<img width="2077" height="1305" alt="image" src="https://github.com/user-attachments/assets/60001ea8-c1b5-4a93-8a4e-9facea3e51d1" />
|
|
|
|
<img width="1116" height="319" alt="image" src="https://github.com/user-attachments/assets/283d6071-dc66-4633-a4d7-c0917c52e751" />
|
|
|
|
| Event ID | Meaning |
|
|
|---|---|
|
|
| 1000 | Subscription installed |
|
|
| 1001 | Subscription removed |
|
|
| 1002 | Malicious QoS policy removed |
|
|
| 1003 | Remediation failed |
|
|
|
|
**1002 example:** `action=remediate qos_policy=02zxnnzr target=elastic-endpoint.exe throttle_bps=8 tier=tier1-known-edr store=ActiveStore`
|
|
|
|
```powershell
|
|
Get-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='EDRChokerDefense' } -MaxEvents 50
|
|
```
|
|
|
|
Forward `ProviderName="EDRChokerDefense"` via WEF, Splunk UF, Elastic Agent, etc.
|
|
|
|
## Protect the subscription
|
|
|
|
Attackers may delete or modify the WMI objects in `root\subscription` to disable defense. **Baseline** the subscription after install and alert on changes.
|
|
|
|
**Sysmon** (recommended): enable and monitor:
|
|
|
|
| Sysmon ID | What to watch |
|
|
|---|---|
|
|
| **19** | `WmiEventFilter` created/modified/deleted |
|
|
| **20** | `WmiEventConsumer` created/modified/deleted |
|
|
| **21** | `WmiEventFilter` ↔ consumer binding changes |
|
|
|
|
Alert on any activity involving `EDRChokerDefense_QoSFilter`, `EDRChokerDefense_QoSConsumer`, or `EDRChokerDefense_Timer`, and on **new** `ActiveScriptEventConsumer` / `CommandLineEventConsumer` instances outside your change window.
|
|
|
|
**Periodic validation** (GPO/script): `Get-WmiObject -Namespace root\subscription -Class __EventFilter | Where-Object Name -like 'EDRChokerDefense*'`
|
|
|
|
## References
|
|
|
|
- [EDRChoker](https://github.com/TwoSevenOneT/EDRChoker)
|
|
- [EDRChoker research](https://www.zerosalarium.com/2026/06/edrchoker-choking-telemetry-stream-block-edr.html)
|