We made it possible for Santa to stop the pid_suspend call against a client. SIGKILL and SIGSTOP still left as an exercise for the reader because legitimate updaters still use these.
Longer form explainer here northpole.security/blog/edr-freeze
Thanks for calling this out @patrickwardle
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️
Privileged attacker? SIGSTOP the tool ...⏳💥😂
Mitigation (per @PeteMarkowsky) subscribe to/block signals!
docs.google.com/presentation/d…
