Thank you,
contributors
Signed software, everyday admin tools, and trusted infrastructure can hide unexpected behavior. Thank you to the researchers and maintainers documenting that behavior and making the evidence more useful to defenders.
The contributor ledger
Familiar tools. Unfamiliar tactics.
Updated Thursday, October 29, 2026.
| Contributor | Project | Contribution | Source |
|---|---|---|---|
JEJose Enrique Hernandez@josehelps | LOLDrivers | Added a prevention-resource link to the shared navigation and adjusted its spacing for narrow screens. | PR #478 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Clarified the HVCI catalog chart and filtering labels, distinguishing recorded sample behavior from a live comparison against current Windows policy. | PR #485 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Fixed README badge generation to count driver entries and known samples separately, with publishing regression tests. | PR #486 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Removed redundant per-sample Git LFS rules and added regression checks to reduce conflicts between driver submissions. | PR #487 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Added source and generated-policy safety checks to CI, distinguishing exact hashes from hunting leads and excluding context-only evidence from blocking outputs. | PR #488 |
JEJose Enrique Hernandez@josehelps | LOLDrivers | Excluded temporary research downloads from Git staging so catalog generation commits contain their intended outputs. | PR #491 |
AMAndrea Monzani@mnznndr97 | LOLDrivers | Added Huawei HWAudioOs2Ec.sys samples and RCFlCtrl.sys process-termination research with vulnerability references. | PR #481 |
AMAndrea Monzani@mnznndr97 | LOLDrivers | Updated fekern.sys research references, acknowledgements, and sample evidence for CVE-2025-14963. | PR #480 |
AMAndrea Monzani@mnznndr97 | LOLDrivers | Added driver samples and references documenting unsafe RtlQueryRegistryValues usage, with vendor-fix context. | PR #479 |
JEJose Enrique Hernandez@josehelps | HijackLibs | Added DLL sideloading entries for SonicWall, IBM WinWrap, Blue Iris, and ON1, linked to published intrusion research. | PR #204 |
JEJose Enrique Hernandez@josehelps | HijackLibs | Added blkscrdl.dll sideloading through Radmin executables, with signing metadata and published SHINYROAD intrusion references. | PR #206 |
JEJose Enrique Hernandez@josehelps | HijackLibs | Added eztwain4.dll sideloading coverage for Nitro executables, with hashes and references to published supply-chain intrusion research. | PR #207 |
LRLiran Ravich@Liran017 | HijackLibs | Documented frameworkbase.dll loading through n-Track Studio's ReportDump.exe, with signed-host metadata and SectopRAT research context. | PR #208 |
Ttimsw1997@timsw1997 | HijackLibs | Added MediaInfo.exe and msvfw32.dll coverage, documented TextMaker.exe loading msimg32.dll, and enriched cmutil.dll metadata. | PR #209 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Added a prevention-resource link to the shared website navigation. | PR #306 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Improved tool-page search descriptions and consolidated ITSupport247 records while preserving legacy URLs and JSON exports. | PR #308 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Added checks for unsafe catalog and generated-rule selectors, preserving contextual evidence without turning shared infrastructure into broad detection targets. | PR #309 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Preserved shared-infrastructure detection context in CSV exports, added round-trip checks, and repaired resource links and redirects. | PR #311 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Consolidated duplicate Level entries while preserving artifacts and references, adding research context and redirects for existing consumers. | PR #314 |
JEJose Enrique Hernandez@josehelps | LOLRMM | Consolidated Quick Assist records, added Microsoft and Arctic Wolf research, and preserved retired page and JSON URLs. | PR #315 |
MHMichael Haag@MHaggis | LOLRMM | Added RdViewer with vendor and phishing-campaign evidence, scoped Windows artifacts, and clear limits on unverified Unix details. | PR #304 |
MHMichael Haag@MHaggis | LOLRMM | Added 2Pint StifleR Enterprise Remote Tools with vendor-backed capabilities, client paths, service and event-log artifacts, and explicit verification limits. | PR #316 |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Added the lhr.life domain pattern to localhost.run detection context. | Commit db364f8 |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Repaired contributor attribution and YAML syntax in the localhost.run entry after its domain update. | Commit f8ef5ab |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Added goshs tunnel-mode documentation, including localhost.run infrastructure and relevant command and domain indicators. | Commit e042310 |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Updated the catalog logo and favicon to match the site's theme. | Commit 1a58bc7 |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Added category filters and visible-entry counts to the catalog, alongside updated social-preview metadata. | Commit 3a1f264 |
KSKamran Saifullah@deFr0ggy | LOT Tunnels | Repaired the shared page template after the metadata update, restoring title, stylesheet, viewport, and script elements. | Commit d6fc426 |
Project
LOLDriversContribution
Added a prevention-resource link to the shared navigation and adjusted its spacing for narrow screens.
Project
LOLDriversContribution
Clarified the HVCI catalog chart and filtering labels, distinguishing recorded sample behavior from a live comparison against current Windows policy.
Project
LOLDriversContribution
Fixed README badge generation to count driver entries and known samples separately, with publishing regression tests.
Project
LOLDriversContribution
Removed redundant per-sample Git LFS rules and added regression checks to reduce conflicts between driver submissions.
Project
LOLDriversContribution
Added source and generated-policy safety checks to CI, distinguishing exact hashes from hunting leads and excluding context-only evidence from blocking outputs.
Project
LOLDriversContribution
Excluded temporary research downloads from Git staging so catalog generation commits contain their intended outputs.
Project
LOLDriversContribution
Added Huawei HWAudioOs2Ec.sys samples and RCFlCtrl.sys process-termination research with vulnerability references.
Project
LOLDriversContribution
Updated fekern.sys research references, acknowledgements, and sample evidence for CVE-2025-14963.
Project
LOLDriversContribution
Added driver samples and references documenting unsafe RtlQueryRegistryValues usage, with vendor-fix context.
Project
HijackLibsContribution
Added DLL sideloading entries for SonicWall, IBM WinWrap, Blue Iris, and ON1, linked to published intrusion research.
Project
HijackLibsContribution
Added blkscrdl.dll sideloading through Radmin executables, with signing metadata and published SHINYROAD intrusion references.
Project
HijackLibsContribution
Added eztwain4.dll sideloading coverage for Nitro executables, with hashes and references to published supply-chain intrusion research.
Project
HijackLibsContribution
Documented frameworkbase.dll loading through n-Track Studio's ReportDump.exe, with signed-host metadata and SectopRAT research context.
Project
HijackLibsContribution
Added MediaInfo.exe and msvfw32.dll coverage, documented TextMaker.exe loading msimg32.dll, and enriched cmutil.dll metadata.
Project
LOLRMMContribution
Added a prevention-resource link to the shared website navigation.
Project
LOLRMMContribution
Improved tool-page search descriptions and consolidated ITSupport247 records while preserving legacy URLs and JSON exports.
Project
LOLRMMContribution
Added checks for unsafe catalog and generated-rule selectors, preserving contextual evidence without turning shared infrastructure into broad detection targets.
Project
LOLRMMContribution
Preserved shared-infrastructure detection context in CSV exports, added round-trip checks, and repaired resource links and redirects.
Project
LOLRMMContribution
Consolidated duplicate Level entries while preserving artifacts and references, adding research context and redirects for existing consumers.
Project
LOLRMMContribution
Consolidated Quick Assist records, added Microsoft and Arctic Wolf research, and preserved retired page and JSON URLs.
Project
LOLRMMContribution
Added RdViewer with vendor and phishing-campaign evidence, scoped Windows artifacts, and clear limits on unverified Unix details.
Project
LOLRMMContribution
Added 2Pint StifleR Enterprise Remote Tools with vendor-backed capabilities, client paths, service and event-log artifacts, and explicit verification limits.
Project
LOT TunnelsContribution
Added the lhr.life domain pattern to localhost.run detection context.
Project
LOT TunnelsContribution
Repaired contributor attribution and YAML syntax in the localhost.run entry after its domain update.
Project
LOT TunnelsContribution
Added goshs tunnel-mode documentation, including localhost.run infrastructure and relevant command and domain indicators.
Project
LOT TunnelsContribution
Updated the catalog logo and favicon to match the site's theme.
Project
LOT TunnelsContribution
Added category filters and visible-entry counts to the catalog, alongside updated social-preview metadata.
Project
LOT TunnelsContribution
Repaired the shared page template after the metadata update, restoring title, stylesheet, viewport, and script elements.
Open research becomes real protection when defenders choose to share what they know.