Thank you,
contributors
Every sample verified, artifact documented, and assumption challenged gives defenders more to work with. Thank you to the researchers and maintainers making living-off-the-land activity easier to understand.
The contributor ledger
More eyes. Fewer blind spots.
Updated Thursday, October 22, 2026.
| Contributor | Project | Contribution | Source |
|---|---|---|---|
EXElement Xu@Element2023H | LOLDrivers | Added the Realtek RtsUpx.sys 1.13.0.0 sample, extracted metadata, and distinct references for four published CVEs. | PR #472 |
Hhax0r31337@hax0r31337 | LOLDrivers | Added three NeacSafe64.sys builds and clarified how their reported behavior differs from the older CVE-2025-45737 sample. | PR #467 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Added Cisco Talos MANTLEMAZE reporting to the iqvw64e.sys entry, including the published analysis-evasion context. | PR #464 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Expanded NSecKrnl.sys references with Reynolds and Warlock ransomware reporting. | PR #470 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Added the HeySafe-X heysafe_drv.sys sample and static behavior analysis, separating verified process-termination paths from unsupported submission claims. | PR #471 |
MHMichael Haag@MHaggis | LOLDrivers | Added libwasys.sys and MonProcessControl.sys samples linked to published KillerLand research, with metadata and static behavior notes. | PR #475 |
MHMichael Haag@MHaggis | LOLDrivers | Added TrueSight.sys 2.0.2 with sample metadata and static analysis of its process-termination path. | PR #476 |
MHMichael Haag@MHaggis | LOLDrivers | Added AmdTools64.sys 1.7.16.218 with sample metadata, static physical-memory mapping analysis, and explicit administrator-access requirements. | PR #477 |
JOJose Oregon@j-oregon | HijackLibs | Documented archive.dll sideloading in Siemens Software Center, with executable hashes and the vendor advisory. | PR #205 |
BCBrendan Chamberlain@infosecB | LOOBins | Added llms.txt and per-binary Markdown endpoints, plus scheduled broken-link and catalog-coverage scans. | PR #284 |
BCBrendan Chamberlain@infosecB | LOOBins | Added a sitemap index endpoint at /sitemap.xml for catalog discovery. | PR #285 |
BCBrendan Chamberlain@infosecB | LOOBins | Fixed the automatic release workflow's race condition so version changes reach main before publication. | PR #286 |
NMNounou Mbeiri@CTI-Driven | lolbins-cti driven | Rebuilt the catalog around 17 Windows binaries with sourced threat context, embedded STIX and JSON graphs, and KQL hunting queries. | Commit e018dce |
NMNounou Mbeiri@CTI-Driven | lolbins-cti driven | Updated the README video link to the new catalog demonstration. | Commit 7e44a44 |
NMNounou Mbeiri@CTI-Driven | lolbins-cti driven | Updated the website's video demonstration link to match the refreshed catalog. | Commit 985f0d7 |
Ccyberbuff@cyberbuff | LOLRMM | Refreshed dependencies and configured grouped Dependabot updates with three-day release cooldowns and a matching Poetry solver policy. | PR #289 |
Ccyberbuff@cyberbuff | LOLRMM | Added Ping32 with endpoint artifacts, screen-monitoring capabilities, and references to documented abuse campaigns. | PR #288 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Clarified the Vicarius vRx role in an INC Ransom intrusion and added executable and code-signing metadata. | PR #285 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Corrected the Vicarius vRx description to call the embedded payload a Shellter payload rather than a packed executable. | PR #301 |
MHMichael Haag@MHaggis | LOLRMM | Added VS Code Remote Tunnels with reported abuse, platform-specific persistence artifacts, and detection coverage limitations. | PR #303 |
Project
LOLDriversContribution
Added the Realtek RtsUpx.sys 1.13.0.0 sample, extracted metadata, and distinct references for four published CVEs.
Project
LOLDriversContribution
Added three NeacSafe64.sys builds and clarified how their reported behavior differs from the older CVE-2025-45737 sample.
Project
LOLDriversContribution
Added Cisco Talos MANTLEMAZE reporting to the iqvw64e.sys entry, including the published analysis-evasion context.
Project
LOLDriversContribution
Expanded NSecKrnl.sys references with Reynolds and Warlock ransomware reporting.
Project
LOLDriversContribution
Added the HeySafe-X heysafe_drv.sys sample and static behavior analysis, separating verified process-termination paths from unsupported submission claims.
Project
LOLDriversContribution
Added libwasys.sys and MonProcessControl.sys samples linked to published KillerLand research, with metadata and static behavior notes.
Project
LOLDriversContribution
Added TrueSight.sys 2.0.2 with sample metadata and static analysis of its process-termination path.
Project
LOLDriversContribution
Added AmdTools64.sys 1.7.16.218 with sample metadata, static physical-memory mapping analysis, and explicit administrator-access requirements.
Project
HijackLibsContribution
Documented archive.dll sideloading in Siemens Software Center, with executable hashes and the vendor advisory.
Project
LOOBinsContribution
Added llms.txt and per-binary Markdown endpoints, plus scheduled broken-link and catalog-coverage scans.
Project
LOOBinsContribution
Added a sitemap index endpoint at /sitemap.xml for catalog discovery.
Project
LOOBinsContribution
Fixed the automatic release workflow's race condition so version changes reach main before publication.
Project
lolbins-cti drivenContribution
Rebuilt the catalog around 17 Windows binaries with sourced threat context, embedded STIX and JSON graphs, and KQL hunting queries.
Project
lolbins-cti drivenContribution
Updated the README video link to the new catalog demonstration.
Project
lolbins-cti drivenContribution
Updated the website's video demonstration link to match the refreshed catalog.
Project
LOLRMMContribution
Refreshed dependencies and configured grouped Dependabot updates with three-day release cooldowns and a matching Poetry solver policy.
Project
LOLRMMContribution
Added Ping32 with endpoint artifacts, screen-monitoring capabilities, and references to documented abuse campaigns.
Project
LOLRMMContribution
Clarified the Vicarius vRx role in an INC Ransom intrusion and added executable and code-signing metadata.
Project
LOLRMMContribution
Corrected the Vicarius vRx description to call the embedded payload a Shellter payload rather than a packed executable.
Project
LOLRMMContribution
Added VS Code Remote Tunnels with reported abuse, platform-specific persistence artifacts, and detection coverage limitations.
Open research becomes real protection when defenders choose to share what they know.