This is probably the most common, known & least stealthy option for malware to persist This year Kristin Smith gave a solid talk at BSides Canberra on using models & our file access rules to find anomalous creation LaunchDaemons You can see the talk here youtube.com/watch?v=YJWf...

This is an oldie but can still be relevant. @theevilbit.bsky.social calls it out directly in his blog series Beyond Good Ol' LaunchAgents theevilbit.github.io/beyond/beyon...

This is a super common technique for infostealers e.g. Huntress blogged about this yesterday www.huntress.com/blog/amos-st... just blogged about AMOS doing this yesterday, after tricking users to install their malware via AI generated instructions to use bash and curl.

One thing I like about our system is that it's easy to make these kinda trip wires where you can lock these things down. But quickly make an exception if you need to allow something and then dial it back off.

This is another simple but powerful control. You almost never need to disable Gatekeeper. And if you do you should be able to handle that on a case by case basis.

Stopping things like infostealers by locking down the cookie jar to just the signed browser processes is a simple but powerful control While Chrome is working on Device Bound Session Credentials (DBSC). You can deploy this today. Also if you use another browser like Firefox, it'll still work.

This is a great feature that I'm using daily. Honestly feels like we found a solid way to close the monitor mode is always on for devs gap. Super proud of the team @northpolesec.bsky.social for landing this

Join us in celebrating North Pole Security's first anniversary! 🎉 Reflect on a year of innovation, growth, & unwavering commitment to livable security with Santa and Workshop. Read about our journey and what's next! #FirstAnniversary #Santa #Workshop northpole.security/blog/one-yea...

Headed to hacker summer camp looking first to seeing people and sharing @northpolesec.bsky.social’s Workshop with people.

It's not just one release, it's two!

It's been an 11 month journey to build Workshop, the integrated backend Santa always deserved Lots of things we'd always wanted at Google are now real The MVP's already powerful & we're just getting started Thank you to Zane & the team at A16Z, Royal Hansen and the team @northpolesec.bsky.social

I made this gist gist.github.com/pmarkowsky/9... to show how @northpolesec.bsky.social Santa FAA rules lockdown the Spotlight importers used in Sploitlight microsoft.com/en-us/securi... & @theevilbit.bsky.social's persistence trick. I also added an example rule for blocking access to the DBs.

Going to be attending @bsideslv.org and around. Summer camp. If you’re around say hello.

This was a big release. Getting CEL in opens up so many possibilities and like all good things it's a take what you need. Really looking forward to seeing what people do with this.

Lots of great features in 2025.5. Santa is now easier to use without having to drop to the command line. Be sure to check out the videos in the 🧵

Have to admit it's exciting to see years of work coming together.

Very exciting to see Santa called out as a tool that works in the @specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social www.youtube.com/watch?v=t_L2...

📢 Last week we released Santa v2025.4 github.com/northpolesec... Along with some big changes 🧵

Today we released Santa v2025.3 on GitHub github.com/northpolesec.... This release includes a handful of new features.

In order to learn MCP I wrote a quick server on top of @northpolesec.bsky.social's Santa github.com/pmarkowsky/s... it provides readonly functionality and debugging.

We agree with CISA and think you should use Santa too www.cisa.gov/sites/defaul...

Today in adventures in open source. We've had one user make a PR to update docs 🎉 And on a call a user said thank you for what you folks are doing in the community. Not gonna lie this is pretty great to be on the receiving end of this.

📣 We’ve just released Santa v2025.2 on GitHub. github.com/northpolesec... Some highlights include: - Process-centric File Access Authorization rules are now in Beta! This means FAA rules can now target all access from a given process without knowing the files that will be accessed ahead of time.

Last night we released Santa 2025.1 github.com/northpolesec... Notable features include: Entitlements in the Sync Protocol This allows you to avoid authorizing or see which applications are disabling code signing on libraries.

Today we're excited to release Santa v2024.11! github.com/northpolesec... Highlights: 1. Our initial beta for standalone mode: This lets you authorize binaries using TouchID. So you can live in lockdown mode. www.youtube.com/watch?v=Hd4t...

Le sigh, I clearly need an edit button. The typos will continue until my ADHD subsides.

I want to see the next startup show in which the first thing a founder does is go oh shit how do I setup quickbooks and payroll? We need a company credit card!?

Our co-founders (Russell Hancox and @plm.bsky.social) were recently on the @MacAdmPodcast talking about Santa and @northpolesec.bsky.social podcast.macadmins.org/2024/11/19/e...

Today is Santa's 10th Birthday 🎂🎉. The first commit was from Russell Hancox at 4:23 PM

This was really really interesting dynomight.net/chess/ TL;DR one model out of the set does well the rest do very poorly vs. the Chess AI stockfish on the lowest setting. I didn't expect chat-gpt-3.5-turbo-instruct to do so well.

As seen from @ddz.bsky.social on X: The entire 3rd-edition of Ross Anderson's "Security Engineering" is available free as PDFs now! cl.cam.ac.uk/archive/rja1...

Really proud to be working with the team on this.

Heard a rumor that infosec folks are moving over here now. Hope it’s true.

Once more unto the breach dear friends.

Bluesky now has over 10 million users, and I was #140,839!

I’d tell you a funny joke about Actaeon but my dogs are barking.

Anyone going to summercon?

Trying to rebuild the timeline of people I follow on Twitter here and ran into an interesting bug browsing someone’s followers. Seems to pick one every time I scroll.

So far I like the interface of this better than I liked mastodon. The odd flashing on refresh bug seems to have stopped.

Is anyone else seeing the app for this glitch?