Security Stuff — #osquery Technical Steering Committee member, likes macOS internals
Seattle
Joined March 2008
- Tweets955
- Following1.6K
- Followers531
- Likes4K
Sharvil Shah retweeted
Today we passed a milestone: more PRs merged into Santa at North Pole Security than in ten years at Google.
Huge respect for Santa's decade @Google, but it's been amazing to watch this team move.
Sharvil Shah retweeted
We've posted some new research on our blog.
EDR Freeze on macOS: how attackers can silently freeze a security tool with pid_suspend, why it works, and how to defend against it (Santa's been protected since 2025.12).
northpole.security/blog/edr-…
Sharvil Shah retweeted
Lots of the hardening in this release came from us proactively auditing Santa w/LLMs
If you're responsible for any OSS, I highly recommend doing the same. You want to be the one finding the bugs first
Very happy we invested heavily in design, least privilege & invariants
Santa v2026.4 is out 🎅
🎄 Strengthened anti-tamper protections
🎄 Clean syncs now replace all sync-managed settings (not just rules)
🎄Per-device silencing of blocked media alerts
🎄SyncBaseURL must be HTTPS
🎄Idiomatic macOS keyboard shortcuts
Read more:
northpole.security/blog/sant…
Release Notes:
github.com/northpolesec/sant…
Some belated personal news, so excited to have joined @northpolesec! It’s been amazing working on proactive endpoint security with @PeteMarkowsky and everyone at North Pole Security!
So much good stuff in 2026.2 with more to come.
Process tree rules with Workshop is something we've been trying to get into Santa for years it is amazing to finally have it here!
Also big shout out to @sharvil who joined @northpolesec recently. He's great and we're so glad he's here.
Sharvil Shah retweeted
Very exciting to see Santa called out as a tool that works in the @SpecterOps SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai
youtube.com/watch?v=t_L2bdbX…
Sharvil Shah retweeted
NEW: We have launched a glossary where we have a series of cybersecurity terms and their definitions.
This page will be periodically updated to add more terms, as it's meant to be a live resource for all our readers.
Please let us know what to add!
techcrunch.com/2024/09/22/te…
Sharvil Shah retweeted
This talk by @slashnick0 on stopping CookieTheft on macOS (using Santa and OSQuery) youtube.com/live/ZY26xH9nim8… was solid.
I also do professional services, custom osquery development and macOS agent, EndpointSecurity, systems programming! Hit me up if you would like something implemented!
Huge shout out to @sharvil who wrote the code and is an absolute pleasure to work with in every way.
Had so much fun working on this with @Centurion and @material_sec! EndpointSecurity based File Integrity Monitoring in #osquery, particularly for file open events is a game changer for detections on macOS
I've always thought that having the ability to set tripwires on arbitrary files on an endpoint would be a huge defensive advantage. Today, that is now a reality for all users of osquery in macOS: material.security/blog/prote…
Super stoked about this talk at #OBTS! @PeteMarkowsky and @byaaaaahhh sharing ins and outs of the Santa agent on macOS, very cool!
Excellent new tool release — Kronos, to augment TCC data on macOS by @rookuu_ and @_calumhall at #OBTS
Excellent talk (and epic graphics) on reversing RustBucket on macOS by @jbradley89 and @malwarezoo at #OBTS
Sharvil Shah retweeted
We have some exciting news! Join @patrickwardle @andyrozen and our host @x71n3 to talk about Objective-We on October 10th at 6:30PM CET! Check us out on YouTube.com/@herhaxpodcast live or for the replay!