Thank you,
contributors.

Project

Contribution

Added a pmxdrv.sys sample and research references describing its physical-memory access behavior.

Project

Contribution

Made catalog-counter publishing retry concurrent main-branch changes, with bounded retries and regression coverage.

Project

Contribution

Added the rwdrv.sys alias and Akira research context for ThrottleStop.sys, plus a DFIR Report reference for hlpdrv.sys.

Project

Contribution

Added a discoverable guide to public driver records, feeds, defensive resources, and contribution documentation.

Project

Contribution

Added ANY.RUN's IronChain analysis to four existing driver entries, retaining the source's static-analysis and execution limitations.

Project

Contribution

Improved website discovery with structured metadata, page descriptions, and legacy-route handling.

Project

Contribution

Refreshed the README for the Astro website, including a current screenshot and separate driver-entry and sample counts.

Project

Contribution

Added the ollama.sys sample described in Elastic's RONINGLOADER research and strengthened export handling for its catalog metadata.

Project

Contribution

Added CVE-2025-68947 and ransomware research references to the existing NSecKrnl.sys entry.

Project

Contribution

Corrected ClamAV export generation to use driver hashes and sizes from valid Git LFS pointers or hydrated binaries, with regression tests.

Project

Contribution

Added reviewed Huorong, 360 Total Security, and Comodo driver samples, distinguishing static findings, reported behavior, and caller prerequisites.

Project

Contribution

Added DefenderAiPlatform.dll and DsCoreFull.dll entries and expanded existing Microsoft DLL sideloading records.

Project

Contribution

Documented consent.exe as an executable that can sideload msimg32.dll.

Project

Contribution

Added sideloading entries for winsparkle.dll and vim64.dll, including supporting executable and path details.

Project

Contribution

Documented gatherosstate.exe as an additional executable for slc.dll sideloading.

Project

Contribution

Added Oracle Java sideloading coverage for deploy.dll through javacpl.exe.

Project

Contribution

Added a Stardock deelevator64.dll sideloading entry with executable and path evidence.

Project

Contribution

Added a Canon ceiinfolog.dll sideloading entry with executable and path evidence.

Project

Contribution

Added Ghostscript sideloading coverage for gsdll64.dll with its console and graphical executables.

Project

Contribution

Added pbcopy coverage describing clipboard access through the macOS command line.

Project

Contribution

Added documentation for the macOS trash command and its file-removal behavior.

Project

Contribution

Added diskutil coverage with documented disk-management use cases and supporting references.

Project

Contribution

Added pmset coverage for macOS power-management behavior and supporting references.

Project

Contribution

Added ldapsearch documentation for directory-query behavior and supporting references.

Project

Contribution

Configured the repository's Claude GitHub Actions workflow.

Project

Contribution

Restricted the automated code-review workflow to avoid running it on fork pull requests.

Project

Contribution

Added a page highlighting projects and resources that use the catalog.

Project

Contribution

Improved the binary catalog with filters and a table view, and refined navigation and detail-page presentation.

Project

Contribution

Added killall documentation covering its use to terminate macOS processes.

Project

Contribution

Fixed executable-name extraction in generic RMM detections and made domain output deterministic, with handling for empty installation paths.

Project

Contribution

Added AnyDesk custom-client installation paths, file and registry artifacts, and service-event coverage.

Project

Contribution

Migrated the public catalog to Astro with static detail pages, catalog-growth exploration, responsive filters, and preserved tool links and downloads.

Project

Contribution

Expanded RustDesk and Cloudflare Tunnel records with source-backed service, command-line, configuration, and forensic artifacts.

Project

Contribution

Added Overlord coverage and expanded ngrok references using ANY.RUN's published research.

Project

Contribution

Expanded ScreenConnect forensic artifacts using published research into a disguised feedback-tool installer.

Project

Contribution

Added a GitHub icon to the website navigation and checked its appearance across desktop and mobile themes.

Project

Contribution

Added a discoverable guide to public catalog records, feeds, detection guidance, and contribution sources.

Project

Contribution

Improved sitemap metadata, canonical links, structured data, and crawler guidance for the public catalog.

Project

Contribution

Added N-able N-central coverage with documented agent paths, platform details, and network indicators.

Project

Contribution

Added Vicarius vRx catalog coverage with remote-management indicators and supporting references.

Project

Contribution

Separated tested site deployment from generated-data publishing and added release-workflow regression checks.

Project

Contribution

Updated generated-data publishing to use a scoped GitHub App so its pull requests can start normal checks automatically.

Project

Contribution

Required directory context for generic process names in generated detections to reduce known indicator collisions.

Project

Contribution

Expanded AnyDesk coverage with direct-connection behavior, file-transfer logs, connection-approval context, and detection references.

Project

Contribution

Expanded ScreenConnect coverage with relay behavior, service and application events, configuration files, and staging artifacts.