Block and monitor EDR Freeze on macOS with Santa and Fleet
Blog post from Fleet
EDR Freeze is a stealthy technique that allows attackers with root access to suspend security tools, making them appear operational while disabling their functionality, posing a threat to macOS systems. Santa, an open-source binary authorization agent for macOS maintained by North Pole Security, has introduced version 2026.3 to counteract this by adding the AntiSuspendSigningIDs configuration, which prevents the suspension of specified processes. The protection can be deployed and monitored using Fleet, which integrates Santa's configuration into existing GitOps workflows, allowing for version-controlled changes without the need for additional infrastructure. Santa's telemetry can detect attempts to suspend processes, and Fleet provides a centralized platform for monitoring the health and status of macOS hosts. This solution leverages existing tools and workflows to enhance security without the overhead of traditional sync servers, using Santa's built-in capabilities to protect against EDR Freeze attacks effectively.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.