Driver intelligence
LOLDrivers
Research vulnerable and malicious Windows drivers, inspect known samples, and understand how attackers use them.
Driver samples and abuse context
Explore LOLDrivers (opens in a new tab)Community Projects
Built by Defenders, for Defenders
Public research and practical tools from the MagicSword team. Explore vulnerable drivers, remote access, agent skills, detection rules, and ways to test your defenses.
Remote access intelligence
LOLRMM
Identify remote monitoring and management tools, their artifacts, and the ways threat actors can abuse legitimate remote access.
RMM tools and detection artifacts
Explore LOLRMM (opens in a new tab)
Agent skill security
LOLSkills
Inspect agent skill instructions, scripts, and bundled files for risky behavior before installation. Review evidence for the version you plan to use.
Skill bundles and scan evidence
Explore LOLSkills (opens in a new tab)
Prevention testing
Magic-Atomics
Turn living-off-the-land research into repeatable, ATT&CK-mapped tests to check whether your security controls block the techniques you care about.
Adversary playbooks and control validation
Explore Magic-Atomics (opens in a new tab)
Detection engineering
Sigconverter
Convert Sigma rules for your detection platform through a web interface powered by pySigma backends.
Sigma rule conversion
Explore Sigconverter (opens in a new tab)
Bootloader intelligence
Bootloaders
Investigate known malicious bootloaders and the research behind persistent threats that operate below the operating system.
Malicious bootloaders and research
Explore Bootloaders (opens in a new tab)Bring a finding, improve a detection, or help test a fix. Contributions help the next defender make a better decision.
Ways to contributePut the Research to Work
See how threat intelligence informs what runs in your environment.