Changelog

v1.1.28 includes 1 update since v1.1.27. This release introduces the LOTL Top Contributors leaderboard, recognizing the most active contributors to LOLDrivers and LOLRMM in 2026.

Highlights

• New LOTL Top Contributors leaderboard
• Recognition for 2026 contributors
• Transparent ranking based on merged PRs and direct commits

Features

• LOTL Top Contributors Leaderboard: You can now view the top contributors to LOLDrivers and LOLRMM for 2026, with rankings based on merged pull requests and direct commits. This provides recognition for community members and transparency into project contributions.

v1.1.27 includes 1 update since v1.1.26. The Prevention Lab Live page now shows the correct EST time and shares a refreshed social preview with updated text and artwork.

Highlights

• Prevention Lab Live schedule now correctly displays Eastern time (EST)
• Shared Prevention Lab Live links show updated preview text and artwork

Fixes

• Show the correct timezone on the Prevention Lab Live schedule: You can now see the schedule label clearly states “Thursday at 2pm EST,” so the exact event time is unambiguous and matches what you’ll get when registering.

v1.1.26 includes 1 update since v1.1.25. Prevention Lab Live moves to Thursdays with updated scheduling and refreshed hero banners for desktop and mobile.

Highlights

• Prevention Lab Live now streams on Thursdays at 2pm ET
• Updated calendar invites and event countdown
• New hero artwork on desktop and mobile

Features

• Prevention Lab Live moves to Thursdays: You can now join Prevention Lab Live on Thursdays at 2pm ET. The schedule and calendar invites have been updated so you never miss the new time.

v1.1.25 includes 1 update since v1.1.24.

Highlights

• LOTL Weekly: 2026-08-28–2026-09-04

Improvements

• LOTL Weekly: 2026-08-28–2026-09-04

v1.1.24 includes 1 update since v1.1.23. The dashboard now shows trustworthy 24-hour summary counts, clearly flags unavailable data, and keeps drill-downs aligned with the Investigate range.

Highlights

• Headline event totals now use a fixed 24-hour window.
• Dashboard drill-downs line up with the 24-hour Investigate range.

Fixes

• Headline counts now reflect a fixed 24-hour window: You can now rely on the dashboard's headline event totals to match exactly the last 24 hours, while existing supporting charts and retention ranges stay as they were.

v1.1.23 includes 4 updates since v1.1.22. Improved EDR killer detection, fixed Windows break-glass enforcement, restored PowerShell deployment script generation, and accelerated dashboard analytics.

Highlights

• Expanded EDR killer detection with new publisher rules
• Fixed Windows break-glass enforcement for legacy agents
• Restored PowerShell deployment script generation for large policies
• Accelerated dashboard analytics loading

Security

• Expanded EDR killer detection: You can now detect EDR killers signed by additional non-Microsoft publishers, including Qihoo, LENOVO, and Wellbia. The rules match exact publisher and CA TBS identities to reduce false positives while covering more driver families.

Fixes

• Fixed Windows break-glass enforcement for legacy agents: Windows endpoints that omit platform info now correctly report their enforcement intent, so break-glass and policy enforcement work reliably on Windows 11 ARM64 and other legacy agents.
• Restored PowerShell deployment script generation: Large policies no longer block the UI when generating PowerShell deployment scripts. Script generation now runs in a worker, handles gzip/base64 payloads, and includes validation and recovery safeguards.

Performance

• Faster dashboard analytics loading: The dashboard now loads analytics up to 50x faster by aggregating data in the database instead of fetching thousands of rows. The initial view appears as soon as summary data is ready, and optional queries no longer block it.

v1.1.22 includes 1 update since v1.1.21. Adds 23 new WDAC rules to block recently disclosed EDR-killer and BYOVD tools, and with enriched identity data.

Highlights

• 23 new WDAC rules for EDR-killer and BYOVD tools
• Authenticode and page hash enrichment for improved accuracy

Features

• New WDAC rules for EDR-killer tools: You now have 23 new WDAC rules to block recently disclosed EDR-killer and BYOVD tools, helping prevent attackers from disabling your endpoint detection and response.

v1.1.21 includes 2 updates since v1.1.20. Added newly detected actively exploited signers to the portal.

Highlights

• Newly detected actively exploited signers added

Features

• Expanded signer coverage: The Portal now includes newly identified signers associated with active exploitation, improving detection of compromised code-signing certificates.

Improvements

• Preserved historical Authentihash controls: Existing Authentihash controls remain active alongside the new signer intelligence, maintaining your existing protection.

v1.1.20 includes 1 update since v1.1.19. MagicSword portal now offers a weekly Living Off the Land contributor changelog with archive navigation and a streamlined publishing workflow.

Highlights

• New weekly LOTL contributor changelog with archive navigation
• First edition covers eight verified contributors across five projects
• Streamlined workflow for publishing future LOTL editions

Features

• Weekly LOTL contributor changelog: A new weekly timeline at /changelog/lotl tracks Living Off the Land contributors, with the first edition covering eight verified contributors across five projects. You can quickly see who contributed and to which projects each week.

v1.1.19 includes 2 updates since v1.1.18. It adds WDAC policy syncing for RMM deployments, protects Slack community requests with CAPTCHA, and ships macOS agent 1.0.0.434 with reliable break-glass recovery across reboots.

Highlights

• CAPTCHA verification on Slack community requests
• WDAC policy sync script for RMM deployments
• macOS agent 1.0.0.434 with reliable break-glass recovery across reboots

Security

• Add CAPTCHA verification to Slack community requests: Adds Cloudflare Turnstile verification to the Slack community request form, blocking automated submissions and protecting your contact details.

Features

• Add WDAC policy sync script for RMM deployments: Introduces a hosted PowerShell script to deploy and update MagicSword WDAC policies across devices via RMM, with automatic cleanup of obsolete policies and safeguards to avoid enforcement gaps.

Fixes

• Improve break-glass recovery in macOS agent 1.0.0.434: You can now use break-glass access more reliably on macOS: agent 1.0.0.434 preserves recovery readiness across reboots and safely returns endpoints to enforcement if recovery state is interrupted or damaged.