Thank you,
contributors
A familiar command can open an unfamiliar path. This week, contributors mapped macOS utilities and clarified ESXi controls—then strengthened the tooling that keeps that knowledge useful. Thank you to the researchers and maintainers behind every source-linked update.
The contributor ledger
Every utility. Another angle.
Updated Thursday, November 12, 2026.
| Contributor | Project | Contribution | Source |
|---|---|---|---|
BCBrendan Chamberlain@infosecB | LOOBins | Refined the LOOBins website layout, search, tactic filtering and binary detail pages. | PR #289 |
BCBrendan Chamberlain@infosecB | LOOBins | Fixed get_loobins() path handling on older Python versions and repaired interpreter selection in the validation workflow. | PR #290 |
BCBrendan Chamberlain@infosecB | LOOBins | Raised the minimum supported Python version to 3.9 and aligned package metadata, test configuration and documentation. | PR #298 |
BCBrendan Chamberlain@infosecB | LOOBins | Added JavaScriptCore jsc execution examples and macOS executable locations, while documenting the absence of a linked public detection rule. | PR #291 |
BCBrendan Chamberlain@infosecB | LOOBins | Added systemextensionsctl discovery and management examples with System Integrity Protection requirements and explicit verification limits. | PR #293 |
BCBrendan Chamberlain@infosecB | LOOBins | Expanded the coverage scan with research-source collection, a reading list and review logs, and made it fail when no sources were reviewed. | PR #299 |
BCBrendan Chamberlain@infosecB | LOOBins | Corrected the Python test matrix and enforced the documented tag taxonomy in validation. | PR #300 |
BCBrendan Chamberlain@infosecB | LOOBins | Made release tests provision Python interpreters through uv and fail when a required test interpreter is missing. | PR #301 |
BCBrendan Chamberlain@infosecB | LOOBins | Added ATT&CK technique and sub-technique IDs and migrated tactic mappings to v20 across the data, SDK, website and exports. | PR #302 |
BCBrendan Chamberlain@infosecB | LOOBins | Moved PyPI publishing to a nightly or manually triggered workflow that skips releases when the source has not changed. | PR #305 |
BCBrendan Chamberlain@infosecB | LOOBins | Documented Shortcuts discovery and execution through the shortcuts CLI, including file inputs and the scripting setting required by some actions. | PR #292 |
BCBrendan Chamberlain@infosecB | LOOBins | Added fdesetup coverage for FileVault discovery, recovery-key operations and restart behavior, with privilege and verification limits. | PR #294 |
BCBrendan Chamberlain@infosecB | LOOBins | Documented mdutil commands for inspecting and managing Spotlight indexing, distinguishing verified status queries from state-changing examples. | PR #295 |
BCBrendan Chamberlain@infosecB | LOOBins | Added pluginkit coverage for discovering and managing macOS plug-ins, including extension enablement and persistence considerations. | PR #296 |
BCBrendan Chamberlain@infosecB | LOOBins | Updated the new macOS entries to the ATT&CK v20 tactic taxonomy, fixing validation that blocked the site build. | PR #306 |
LRLiran Ravich@Liran017 | LOLESXi | Documented separate runtime and boot-time execInstalledOnly controls in esxcli, with ESXi version limits and explicit distinctions between observed research and untested commands. | PR #43 |
Project
LOOBinsContribution
Refined the LOOBins website layout, search, tactic filtering and binary detail pages.
Project
LOOBinsContribution
Fixed get_loobins() path handling on older Python versions and repaired interpreter selection in the validation workflow.
Project
LOOBinsContribution
Raised the minimum supported Python version to 3.9 and aligned package metadata, test configuration and documentation.
Project
LOOBinsContribution
Added JavaScriptCore jsc execution examples and macOS executable locations, while documenting the absence of a linked public detection rule.
Project
LOOBinsContribution
Added systemextensionsctl discovery and management examples with System Integrity Protection requirements and explicit verification limits.
Project
LOOBinsContribution
Expanded the coverage scan with research-source collection, a reading list and review logs, and made it fail when no sources were reviewed.
Project
LOOBinsContribution
Corrected the Python test matrix and enforced the documented tag taxonomy in validation.
Project
LOOBinsContribution
Made release tests provision Python interpreters through uv and fail when a required test interpreter is missing.
Project
LOOBinsContribution
Added ATT&CK technique and sub-technique IDs and migrated tactic mappings to v20 across the data, SDK, website and exports.
Project
LOOBinsContribution
Moved PyPI publishing to a nightly or manually triggered workflow that skips releases when the source has not changed.
Project
LOOBinsContribution
Documented Shortcuts discovery and execution through the shortcuts CLI, including file inputs and the scripting setting required by some actions.
Project
LOOBinsContribution
Added fdesetup coverage for FileVault discovery, recovery-key operations and restart behavior, with privilege and verification limits.
Project
LOOBinsContribution
Documented mdutil commands for inspecting and managing Spotlight indexing, distinguishing verified status queries from state-changing examples.
Project
LOOBinsContribution
Added pluginkit coverage for discovering and managing macOS plug-ins, including extension enablement and persistence considerations.
Project
LOOBinsContribution
Updated the new macOS entries to the ATT&CK v20 tactic taxonomy, fixing validation that blocked the site build.
Project
LOLESXiContribution
Documented separate runtime and boot-time execInstalledOnly controls in esxcli, with ESXi version limits and explicit distinctions between observed research and untested commands.
Open research becomes real protection when defenders choose to share what they know.