Thank you,
contributors.
You turned research into shared defense—and made the industry a little safer this week. Here’s to the people improving the Living Off the Land projects defenders rely on.
The contributor ledger
Research that moved defense forward.
Updated Friday, August 28, 2026.
| Contributor | Project | Contribution | Source |
|---|---|---|---|
MMMario Madersbacher@mmadersbacher | LOLBAS | Added Vssadmin.exe, documenting shadow-copy deletion and T1490 recovery inhibition. | PR #520 |
NSnasawyer7@nasawyer7 | LOLBAS | Added AppLaunch.exe for ClickOnce execution and application-control and SmartScreen bypass. | PR #519 |
KOKoifman@Koifman | HijackLibs | Added the OneDrive wtsapi32.dll sideloading case associated with C2Looper. | PR #189 |
FFFaraday / Austin@0xFFaraday | HijackLibs | Added Macrium Reflect reflecttheme.dll sideloading observed with a fake Teams installer. | PR #187 |
CJChrisJr404@ChrisJr404 | LOLRMM | Added BreezeRMM, including agent filenames, installation paths, and vendor domains for detection. | PR #241 |
JHJose Enrique Hernandez@josehelps | LOLRMM | Fixed deployment, Sigma generation, and badge workflows by regenerating against current main. | PR #240 |
JHJose Enrique Hernandez@josehelps | LOLDrivers | Added Alinubx.sys and DCRCVDrv.sys, documenting two Cruciferra MaaS BYOVD process-killer drivers. | PR #413 |
JTJeffrey Tigchelaar@jeffreytigch | LOT Tunnels | Added SSH-J, Gsocket, Qsocket, and Tailscale tunnel or service entries with their associated domains. | PR #17 |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Made four direct follow-up commits correcting categories and metadata for the new tunnel entries. | Compare |
Project
LOLBASContribution
Added Vssadmin.exe, documenting shadow-copy deletion and T1490 recovery inhibition.
Project
LOLBASContribution
Added AppLaunch.exe for ClickOnce execution and application-control and SmartScreen bypass.
Project
HijackLibsContribution
Added the OneDrive wtsapi32.dll sideloading case associated with C2Looper.
Project
HijackLibsContribution
Added Macrium Reflect reflecttheme.dll sideloading observed with a fake Teams installer.
Project
LOLRMMContribution
Added BreezeRMM, including agent filenames, installation paths, and vendor domains for detection.
Project
LOLRMMContribution
Fixed deployment, Sigma generation, and badge workflows by regenerating against current main.
Project
LOLDriversContribution
Added Alinubx.sys and DCRCVDrv.sys, documenting two Cruciferra MaaS BYOVD process-killer drivers.
Project
LOT TunnelsContribution
Added SSH-J, Gsocket, Qsocket, and Tailscale tunnel or service entries with their associated domains.
Project
LOT TunnelsContribution
Made four direct follow-up commits correcting categories and metadata for the new tunnel entries.
Open research becomes real protection when defenders choose to share what they know.