LOLRMM
The tools attackers use to blend in. Remote access software, artifacts, and detection context.
RESEARCH INTO PREVENTIONAPPLICATION CONTROL, AUTOMATED
Application Control
Without the Overhead
Most teams know they need application control. What stops them is the work it takes to get there… and keep it up to date.
MagicSword builds policies automatically from research on what attackers are abusing. No rules to write. Start in audit, review the impact, and enforce when you’re ready.
Join FreeFree up to 100 endpoints No credit card Start in audit mode
Built by the Team Behind LOLDrivers and LOLRMM
RESEARCH YOU ALREADY KNOWLOLDrivers
The drivers that turn trust into a liability. Vulnerable and malicious Windows driver intelligence.
LOLBAS
The trusted Windows binaries, scripts, and libraries attackers abuse to live off the land.
LOLDrivers and LOLRMM started as research projects to track how attackers abuse legitimate tools. A catalog was not enough. MagicSword turns that research into policies.
01 / LESS WORK TO STAY PROTECTED
Application Control Shouldn’t Be
A Full-Time Job
ThreatLocker
ThreatLocker starts with default-deny allowlisting. Learning Mode helps build your baseline; your team still reviews allowed applications and manages exceptions. It works when you have the team for it.
WDAC
WDAC (App Control for Business) gives you the enforcement engine. Creating, testing, and maintaining its XML policies is still your team’s responsibility.
AppLocker
AppLocker has no driver enforcement or built-in threat-intelligence feed. Microsoft recommends App Control for Business for stronger protection and no longer adds new AppLocker features.
Enforcement is only part of the job. You still need current research on the tools attackers are weaponizing. MagicSword turns that research into policy.
02 / A MOVING TARGET
The Growing
Attack Surface
Attackers don’t need custom malware to cause damage. They abuse legitimate software, trusted binaries, and vulnerable drivers already within reach.
The catalogs keep growing. A policy written once can’t keep pace with new research on its own.
CROWDSTRIKE GLOBAL THREAT REPORT
2020 — 2025The Rise of Malware-Free Detections
82%
of CrowdStrike detections in 2025
were malware-free
New Research Keeps Arriving
Average weekly catalog additions · Jan – Sep 2026
LOLRMM
1.9avg. new entries / week
76 entries over 39 weeksLOLDrivers
4.9avg. new entries / week
190 entries over 39 weeksManual policies cannot keep up.Attached intelligence updates your MagicSword policies automatically as the research changes.
Source: LOLRMM and LOLDrivers project growth data, verified October 26, 2026. Record creation dates, January 1 – September 30, 2026 (273 days ÷ 7 = 39 weeks), including periods with zero additions. LOLRMM includes RMM and RAT entries. Catalog entries, not attacks or individual driver samples. Averages rounded to one decimal.
03 / WORK WITH YOUR AI ASSISTANT
Your Agent
Your Approval
Connect MagicSword to your AI coding agent via MCP. Preview the policy and devices, approve an audit rollout, and review events before you enforce. Requires an existing policy, enrolled agent-managed devices, and an Enterprise API key.
Application Control
Without the Overhead
Policies update automatically every 2 hours. No manual work after setup.
Join FreeFree up to 100 endpoints No credit card Start in audit mode