A weekly thank-you to the researchers, maintainers, and defenders improving the open Living Off the Land projects the industry relies on.
A whole community. One farm.
Meet the people moving Living Off the Land forward.
172
contributors
862
contributions
23
active projects
@cyrus-and · 1 project
@MHaggis · 3 projects
@mthcht · 3 projects
@josehelps · 4 projects
@enesilhaydin · 1 project
1–5 of 172 · All the farm
Jan 1, 2026 – Oct 8, 2026
Cutoff: 9:00 AM Mountain, exclusive. Counts cover 32 audited projects; 5 without auditable history are excluded.
One contribution is one human-authored merged pull request or one independent direct commit to a project’s default branch. A PR’s commits count only with that PR. Bots, generated changes, empty commits and merge-only commits are excluded. Maintainers are included.
Equal totals share a rank; handles sort alphabetically. Search preserves the original ranks. Counts recognize activity, not impact, and contribution conventions vary by project. Issues and reviews aren’t counted. Accounts are combined within a hosting provider, never guessed across providers. The annual window starts January 1 at midnight Mountain; weekly editions close Thursday at 9:00 AM Mountain.
A weekly badge means a person’s first qualifying contribution to that project, verified across its earlier public history, including before 2026. It does not mean they are new to the whole farm. Missing history stays unverified; no badge alone does not mean someone is a returning contributor. A person can be verified as new to one project while their history on another remains unverified. Summary counts cover the selected project scope before contributor search or pagination.
The timeline
Forty-five merged pull requests from 12 contributors landed across LOLDrivers, HijackLibs, LOOBins, and LOLRMM. The work expanded driver and DLL sideloading research, documented macOS utilities, strengthened remote-management artifacts and detections, and improved public catalogs and their publishing workflows.
Ten merged pull requests and two independent direct commits from five contributors landed across LOLDrivers, LOLBAS, LOLRMM, and LOT Tunnels. The work expanded driver, remote-management, and tunneling coverage, added file-creation telemetry context, and improved catalog metrics and maintenance attribution.
Twenty-three pull requests and five independent direct commits from seven contributors landed across LOLDrivers, LOLRMM, and LOT Tunnels. The work expanded driver and remote-management coverage, documented ten tunneling tools, strengthened entry validation, and improved catalog browsing, exports, and contributor credits.
Five pull requests and one independent direct commit from four contributors landed across LOLDrivers, LOLBAS, and LOLSkills. The work improved the driver catalog and its evidence pages, documented Windows execution and DLL-loading techniques, corrected attribution, and released a public skill-checking integration.
Ten pull requests from seven contributors landed across LOLDrivers, LOLRMM, HijackLibs, WADComs, LOOBins, and LOT Tunnels. The work expanded verified driver and RMM coverage, documented a DLL sideloading case and a tunneling service, added scanning examples, and repaired detection references.
Sixteen pull requests from seven contributors landed across LOLBAS, HijackLibs, LOLRMM, and LOLDrivers, alongside direct HijackLibs maintenance from Wietze Beukema. The work added .NET execution research, DLL sideloading cases, RMM coverage, Sigma reliability improvements, and a substantial set of verified vulnerable-driver records and corrections.
Eight pull requests from seven contributors landed across LOLBAS, HijackLibs, LOLRMM, LOLDrivers, and LOT Tunnels, with four direct follow-up fixes from an eighth contributor. The work covered new execution, sideloading, and BYOVD research, stronger detection data, four tunneling services, and a reliability fix for publishing automation.