Security Research & Insights

Prevention Lab Weekly

Deep dives into threat intelligence, application control strategies, and the latest research on living-off-the-land attacks from our security team.

Magic-Atomics: The Prevention Engineer's Toolkit

Prevention-focused LOL testing framework mapped to MITRE ATT&CK. Magic-Atomics is a free, open-source framework that tests whether your preventative controls actually block living-off-the-land techniques. 4,800+ prevention tests, 172 threat groups, one clear answer.

Michael Haag

Threat Researcher

Read article

A glowing neon-blue sword embedded in a dark, futuristic cyber battlefield surrounded by broken systems, burning infrastructure, and scattered circuit boards—symbolizing cybersecurity prevention, blocking common attacker techniques, and breaking the detection-only cycle, aligned with themes of “living off the land” (LOTL), repeated adversary techniques, and the shift from detection engineering to proactive threat prevention in modern enterprise security.

April 14, 202616 min

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

Illustration showing a Windows executable connected through a trust chain to an Apple iOS distribution certificate, highlighting abuse of trusted signing and policy mismatch.

February 17, 202611 min

Apple iOS Distribution Certificate Used to Sign Windows Malware

Sort:

Topics:

All Articles

Threat Research & Intelligence

August 7, 20264 min read

Hallways Over Booths: Reflections from Black Hat 2026

Black Hat 2026 is starting to look a lot like RSA. The marketing spend is wild, the AI messaging blurs together, and the disconnect from actual practitioners is real. But the hallways? Still worth showing up for.

Jose Hernandez

Magic-Atomics prevention testing dashboard showing 715 total techniques, 4,815 tests, 11 data sources, and 174 adversary groups, with a 23% prevention score across 5 runs, a MITRE ATT&CK coverage matrix color-coded by blocked, allowed, and untested techniques, a recent Wizard Spider playbook with 1,281 tests, and LOLBAS listed as an active data source.

Prevention Lab Weekly

Magic-Atomics: The Prevention Engineer's Toolkit

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

Apple iOS Distribution Certificate Used to Sign Windows Malware

Hallways Over Booths: Reflections from Black Hat 2026

Magic-Atomics: The Prevention Engineer's Toolkit

CLM Forge: From Script Chaos to Enforced Trust

Never Say Never: It's Time to Block LOLBAS

Why We Built MagicSword And Why We Almost Didn't

One Endpoint Doesn't Get to Vote: The Iterative Loop From Detection to Prevention

We Stopped Choosing LLMs by Vibe. Here's the Eval Harness We Built Instead

One Click, Full Access: How MagicSword Prevents Malicious ScreenConnect Installs

LOLExfil and ExtSentry Intelligence: MagicSword Now Blocks Exfiltration Tools & Malicious Extensions

RMM Abuse Jumped 277% in a Year. Two Blogs This Week Show Why

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

The Guard and the Thief Carpool

R$1.5 Billion in 12 Months: What the Pix Settlement Attacks Reveal About Where Security Fails

Microsoft Is Killing Cross-Signed Drivers. So Malicious Drivers Are Done... Right?

The Eternal Cybersecurity Pendulum: Why Prevention Is Back

Stop Detecting. Start Preventing. The Case for Mean Time to Prevent (MTTP)

AI Makes Getting In Easy. What Happens Next Is the Real Problem

What is LOLDrivers? The Project That Brought Malicious Drivers Into the Light

Apple iOS Distribution Certificate Used to Sign Windows Malware

What is LOLRMM? The Community-Driven Project Exposing Remote Monitoring Tool Abuse

CISA Called It: Stop RMM Tool Abuse Before Attackers Do

Blocking ClickFix with Intelligence-Driven Application Control

Announcing Cert Graveyard Intelligence in MagicSword

A Quiet Contribution, Long Before the Noise: Northwave and LOLDrivers

TrueSightKiller: 2,500+ Weaponized Security Tool Variants Bypassing Microsoft's Defenses

Allowlisting vs. Blocking Abuse: Two Paths to Application Control

MagicSword Portal - Feature Release Summary

Browser Extension Visibility: Why Inventory Changes the Game

POORTRY Still Active in 2026: The Microsoft Signing Crisis That Won't Go Away

Ghost Certificates: How Decade-Old Code Signing Infrastructure Enables Modern Malware

The $100M Freight Heist That EDR Never Saw Coming

HeartCrypt: The Packer Service That's Helping Ransomware Groups Kill Your EDR

The Great AppLocker Migration

How Scattered Spider Weaponizes "Legitimate" Tools And How to Stop Them

The M&S Breach: A Wake-Up Call for Teams Still Chasing Malware

Announcing LOLRMM: A Unified Approach to RMM Software Tracking

LOLDrivers and HVCI

Streamlining LOLDrivers Contributions Via Streamlit

A Behind-the-Scenes Look at Creating LOLDrivers

Introducing sigconverter.io: The Community-Driven Sigma Translation Tool

Unmasking Malicious Bootloaders with Bootloaders.io

LOLDrivers 2.0: Pioneering Progress

Living Off The Land Drivers 1.0 Release: New Features, Enrichments, and Community Contributions

Living Off The Land Drivers