Shared Research
Stronger Defenses

A home for the researchers, builders, and defenders turning what attackers abuse into knowledge everyone can use

FROM THE FIELD

UPDATED WEEKLY / Oct 8, 2026

Recent Findings

The latest tools, drivers, and techniques documented by the community.

WEEK 41 / LIVING OFF THE LANDRead the weekly findings

Added a pmxdrv.sys sample and research references describing its physical-memory access behavior.

Added DefenderAiPlatform.dll and DsCoreFull.dll entries and expanded existing Microsoft DLL sideloading records.

Added pbcopy coverage describing clipboard access through the macOS command line.

Compare notes, ask questions, and connect with the people behind the research.

Access reviewed by Jose & Mike

Practical attack breakdowns on PLL LIVE, plus Slack-exclusive Intel Drops.

Weekly live · Intel Drops in Slack

Field notes, threat research, and past findings. Read here or get them in your inbox.

One publication. Read your way.

Found an abused tool or driver? Share the evidence and help every defender.

Small contributions. Shared impact.

Weekly research from the blog and Live episode notifications, together in your inbox

Unsubscribe anytime. Privacy policy · Slack access is requested separately.

Take the next step from shared research to actionable threat intelligence in MagicSword.

Create your MagicSword account.