No agent required. Instant protection.

Preventing thousands of malware attacks daily

#1 at stopping living-off-the-land attacks

Home Solution Intelligence Pricing Projects FAQs Blog

Security Research & Insights

The MagicSword Blog

Deep dives into threat intelligence, application control strategies, and the latest research on living-off-the-land attacks from our security team.

Expert Research

Updated Weekly

Free& Open Access

All Articles

Cybersecurity graphic showing a ghost-shaped code-signing certificate stamped ‘REVOKED’ but still labeled ‘TRUSTED’ on a Windows interface, representing how outdated or compromised digital certificates continue to validate malware on modern Windows systems

December 11, 20259 min read

Ghost Certificates: How Decade-Old Code Signing Infrastructure Enables Modern Malware

Attackers are using decade-old certificates to sign modern malware. These “ghost certificates” still load on Windows 11. Here’s why it happens and what defenders can do.

Michael Haag

Visualizing the revocation of major ransomware threats including MedusaZucker, HeartCrypt, and Ransomhub in a dark-mode digital environment

December 1, 20256 min read

HeartCrypt: The Packer Service That's Helping Ransomware Groups Kill Your EDR

HeartCrypt transforms legitimate Windows applications into malicious payload carriers, bypassing traditional defenses and fueling ransomware waves. This article examines how HeartCrypt operates, why it’s a game-changer for threat actors, and how defenders must adapt their detection strategy.

Michael Haag

AppLocker to MagicSword migration interface displaying critical security gaps in legacy policies and recommending kernel-level enforcement.

October 20, 20254 min read

The Great AppLocker Migration

Migrating and auditing AppLocker policies is often messy and error-prone but it doesn’t have to be. This post outlines the Great AppLocker Migration method that helps IT teams clean up rules, close security gaps, and enforce trusted-only execution.

Michael Haag

MagicSword vs Scattered Spider: Visualizing how proactive application control prevents the abuse of legitimate RMM software and malicious bootloaders.

September 5, 20252 min read

How Scattered Spider Weaponizes "Legitimate" Tools And How to Stop Them

The latest FBI/CISA advisory confirms that Scattered Spider is exploiting legitimate remote access tools, not malware, to breach organizations. Traditional security can’t see these attacks, but MagicSword’s LOLRMM intelligence and Application Control stop them at the source.

Michael Haag

Visual representation of security blind spots revealed by the M&S breach

September 2, 20254 min read

The M&S Breach: A Wake-Up Call for Teams Still Chasing Malware

The M&S breach exposed major gaps in defenses that rely only on malware detection. This post explores how attackers bypass traditional protections and why teams must adopt broader detection strategies. It’s a must-read wake-up call for anyone still focused solely on malware.

Michael Haag

Homepage of the LOLRMM project displaying its RMM tool tracking description, resource links, API options, and MagicSword integration for blocking remote management tools

August 25, 20253 min read

Announcing LOLRMM: A Unified Approach to RMM Software Tracking

LOLRMM introduces a centralized, community-driven approach for tracking RMM (Remote Monitoring & Management) software across environments. This tool helps security teams inventory, monitor, and analyze installed RMM tools, improving visibility into remote-management exposures.

Michael Haag

City with a glowing sword above the MagicSword castle, symbolizing strong kernel-level protection using HVCI against malicious LOLDrivers

July 1, 20254 min read

LOLDrivers and HVCI

LOLDrivers now integrates HVCI checks to highlight Windows drivers that can still load with memory integrity enabled. This update helps defenders narrow down a dangerous subset of drivers and prioritize them for blocking or monitoring.

Michael Haag

June 18, 20252 min read

Streamlining LOLDrivers Contributions Via Streamlit

This article shows how we used Streamlit to streamline contributions to LOLDrivers, making it easier for the community to submit and manage driver threat data. The update improves collaboration, simplifies workflow, and accelerates the growth of a robust Windows driver security resource.

Nasreddine Bencherchali

Retro green-screen computer displaying driver listings, symbolizing the analysis process behind creating LOLDrivers

May 15, 20255 min read

A Behind-the-Scenes Look at Creating LOLDrivers

Get an insider’s view of how LOLDrivers came together: the planning, community contributions, and technical work that turned it into a vital resource for tracking vulnerable Windows drivers.

Michael Haag

Screenshot of the sigconverter.io interface showing a Sigma rule and an error during query conversion

April 4, 20254 min read

Introducing sigconverter.io: The Community-Driven Sigma Translation Tool

SigConverter.io simplifies threat detection by automatically converting Sigma rules to multiple formats via a community-driven interface. This tool empowers security professionals to easily translate and deploy detection rules across different platforms.

Jose Hernandez

Cybersecurity illustration symbolizing the detection of stealthy malicious bootloaders

March 12, 20255 min read

Unmasking Malicious Bootloaders with Bootloaders.io

Bootloaders.io reveals how attackers exploit malicious bootloaders to bypass firmware protections and compromise systems at the root level. This tool enables security teams to detect, analyze, and block bootloader-based threats before they gain persistent control.

Michael Haag

LOLDrivers 2.0 detections matrix showing dynamic rule generation for YARA (Exact Match, Threat Hunting, Renamed), Sigma (Names, Hashes), and Sysmon (Block, Alert) for malicious driver files

February 11, 20257 min read

LOLDrivers 2.0: Pioneering Progress

LOLDrivers 2.0 delivers a major upgrade, adding over 750 drivers, dynamic YARA rule generation, CVE enrichment and WDAC support. With these enhancements, security teams gain sharper, more automated detection and prevention for malicious and vulnerable Windows drivers.

Michael Haag

LOLDrivers 1.0 release cyber-graphic showing new features like Authentihash metadata, driver binaries, and community contributions against malicious Windows kernel drivers

January 31, 20256 min read

Living Off The Land Drivers 1.0 Release: New Features, Enrichments, and Community Contributions

LOLDrivers 1.0 brings a centralized, community-driven database of vulnerable and malicious Windows drivers. This release helps security teams detect abuse faster and strengthen their defenses.

Michael Haag

ybersecurity dashboard from LOLDrivers displaying information on malicious Windows drivers

January 13, 20254 min read

Living Off The Land Drivers

Living-off-the-land drivers are becoming a growing blind spot in modern defense. This post introduces LOLDrivers, a centralized resource that catalogs vulnerable and malicious Windows drivers so teams can detect and mitigate abuse faster.

Michael Haag