Prevention Lab Weekly

Deep dives into threat intelligence, application control strategies, and the latest research on living-off-the-land attacks from our security team

Unsubscribe anytime. Privacy policy

Magic-Atomics: The Prevention Engineer's Toolkit

Prevention-focused LOL testing framework mapped to MITRE ATT&CK. Magic-Atomics is a free, open-source framework that tests whether your preventative controls actually block living-off-the-land techniques. 4,800+ prevention tests, 172 threat groups, one clear answer.

Michael Haag

Threat Researcher

Read article

A glowing neon-blue sword embedded in a dark, futuristic cyber battlefield surrounded by broken systems, burning infrastructure, and scattered circuit boards—symbolizing cybersecurity prevention, blocking common attacker techniques, and breaking the detection-only cycle, aligned with themes of “living off the land” (LOTL), repeated adversary techniques, and the shift from detection engineering to proactive threat prevention in modern enterprise security.

April 14, 202616 min

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

Illustration showing a Windows executable connected through a trust chain to an Apple iOS distribution certificate, highlighting abuse of trusted signing and policy mismatch.

February 17, 202611 min

Apple iOS Distribution Certificate Used to Sign Windows Malware

Sort:

Topics:

All Articles

Threat Research & Intelligence

October 12, 202611 min read

The RMM Your Blocklist Hasn’t Met

An RVTools intrusion sent us looking beyond the usual RMM vendors. 15 research leads became 14 proposed LOLRMM additions, with a few reminders along the way that filenames, product labels, and whole-file hashes do not tell the whole story.

Prevention Lab Weekly

The Blog in Your Inbox

Magic-Atomics: The Prevention Engineer's Toolkit

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

Apple iOS Distribution Certificate Used to Sign Windows Malware

The RMM Your Blocklist Hasn’t Met

Fake Adobe, Real RMM: The Hunt That Found 13 Missing Tools

The Security Funnel Has a Hole in It

JemmyLoveJenny: The Windows Driver Signing Trick That Keeps Showing Up

Infostealers Do Not Need Exploits. They Need Your LOLBAS.

How MagicSword Stops ClickFix Across Windows, macOS, and Linux

Hallways Over Booths: Reflections from Black Hat 2026

Magic-Atomics: The Prevention Engineer's Toolkit

CLM Forge: From Script Chaos to Enforced Trust

Never Say Never: It's Time to Block LOLBAS

Why We Built MagicSword And Why We Almost Didn't

One Endpoint Doesn't Get to Vote: The Iterative Loop From Detection to Prevention

We Stopped Choosing LLMs by Vibe. Here's the Eval Harness We Built Instead

One Click, Full Access: How MagicSword Prevents Malicious ScreenConnect Installs

LOLExfil and ExtSentry Intelligence: MagicSword Now Blocks Exfiltration Tools & Malicious Extensions

RMM Abuse Jumped 277% in a Year. Two Blogs This Week Show Why

Get Off the Rat Wheel: The Top 10 Techniques Haven't Changed in a Decade

The Guard and the Thief Carpool

R$1.5 Billion in 12 Months: What the Pix Settlement Attacks Reveal About Where Security Fails

Microsoft Is Killing Cross-Signed Drivers. So Malicious Drivers Are Done... Right?

The Eternal Cybersecurity Pendulum: Why Prevention Is Back

Stop Detecting. Start Preventing. The Case for Mean Time to Prevent (MTTP)

AI Makes Getting In Easy. What Happens Next Is the Real Problem

What is LOLDrivers? The Project That Brought Malicious Drivers Into the Light

Apple iOS Distribution Certificate Used to Sign Windows Malware

What is LOLRMM? The Community-Driven Project Exposing Remote Monitoring Tool Abuse

CISA Called It: Stop RMM Tool Abuse Before Attackers Do

Blocking ClickFix with Intelligence-Driven Application Control

Announcing Cert Graveyard Intelligence in MagicSword

A Quiet Contribution, Long Before the Noise: Northwave and LOLDrivers

TrueSightKiller: 2,500+ Weaponized Security Tool Variants Bypassing Microsoft's Defenses

Allowlisting vs. Blocking Abuse: Two Paths to Application Control

MagicSword Portal - Feature Release Summary

Browser Extension Visibility: Why Inventory Changes the Game

POORTRY Still Active in 2026: The Microsoft Signing Crisis That Won't Go Away

Ghost Certificates: How Decade-Old Code Signing Infrastructure Enables Modern Malware

The $100M Freight Heist That EDR Never Saw Coming

HeartCrypt: The Packer Service That's Helping Ransomware Groups Kill Your EDR

The Great AppLocker Migration

How Scattered Spider Weaponizes "Legitimate" Tools And How to Stop Them

The M&S Breach: A Wake-Up Call for Teams Still Chasing Malware

Announcing LOLRMM: A Unified Approach to RMM Software Tracking

LOLDrivers and HVCI

Streamlining LOLDrivers Contributions Via Streamlit

A Behind-the-Scenes Look at Creating LOLDrivers

Introducing sigconverter.io: The Community-Driven Sigma Translation Tool

Unmasking Malicious Bootloaders with Bootloaders.io

LOLDrivers 2.0: Pioneering Progress

Living Off The Land Drivers 1.0 Release: New Features, Enrichments, and Community Contributions

Living Off The Land Drivers