MagicSword Intelligence

Decide Which Trusted Tools Belong in Your Environment

Attackers often skip custom malware and use what is already trusted: built-in utilities, signed drivers, remote access tools, and code-signing certificates. MagicSword brings public research and our own curated lists together so you can decide what runs on Windows, macOS, and Linux.

Join for free Browse sources

Free forever. No credit card required.

From research to decision

Research Gives Context, Your Policy Makes the Call

Here is how one listed tool moves from public research to a decision on your endpoints.

Illustrative example · AnyDesk

01 · Research
A Public Catalog Documents the Tool
LOLRMM documents AnyDesk: where it installs, what it leaves behind, and how intruders have used it for remote access.
02 · Context
Your Endpoints Show Where It Runs
An endpoint launches AnyDesk.exe and MagicSword links the event to that LOLRMM entry. The match explains why the tool deserves a look. It does not make the file malicious; your help desk may rely on it.
03 · Decision
Your Policy Decides What Runs
You might allow AnyDesk on support devices and block it on servers that should never run remote access tools. A tool is blocked only when a policy you configure says so.

A source match tells you: A file appears in a catalog, and why it is listed. It is context for review, not a malicious verdict.
A policy decision sets: Whether that file runs, and on which devices. Sources inform policies; policies decide what runs.

Sources

Public Research We Draw On

A selection of the public catalogs and software publishers behind MagicSword intelligence, grouped by what they describe. Each link goes to the source itself.

Filter public sources

Find a research source by name, platform, or topic.

Built-In Tools

Operating system binaries and scripts that attackers repurpose because they are already present and trusted.

LOLBAS (opens in a new tab)Platforms: Windows
Maintained by the LOLBAS Project
Windows binaries, scripts, and libraries with documented abuse such as download, execution, and defense bypass.
LOOBins (opens in a new tab)Platforms: macOS
Maintained by the LOOBins community
Built-in macOS binaries and the ways attackers have used them.
GTFOBins (opens in a new tab)Platforms: Linux · macOS
Maintained by the GTFOBins community
Unix binaries that can be misused to escape restrictions, escalate privileges, or transfer files.

Legitimate Software

Real products with valid uses that also help intruders. A listing is not a verdict; it is a prompt to decide where the software belongs.

LOLRMM (opens in a new tab)Platforms: Multi-platform
MagicSword community project
Remote monitoring and management tools, the artifacts they leave, and how attackers use legitimate remote access.
LOLExfil (opens in a new tab)
Maintained by mthcht
Tools threat actors have used to move data out of an environment.
Sysinternals (opens in a new tab)Platforms: Windows
Published by Microsoft
Administration and diagnostic utilities that are as useful to an intruder as they are to IT.
NirSoft (opens in a new tab)Platforms: Windows
Published by NirSoft
Freeware utilities, including password-recovery tools that can expose stored credentials.
joeware (opens in a new tab)Platforms: Windows
Published by joeware
Active Directory and Windows administration utilities, such as AdFind, that can support reconnaissance.

Drivers and Extensions

Components that load with elevated trust in the kernel or the browser.

LOLDrivers (opens in a new tab)Platforms: Windows
MagicSword community project
Vulnerable and malicious drivers used to reach the kernel or disable security tools.
ExtSentry (opens in a new tab)Platforms: Chrome · Edge
Maintained by mthcht
Malicious, compromised, and suspicious browser extensions.

Code-Signing Certificates

Certificates that make malicious files look trustworthy at a glance.

Cert Graveyard (opens in a new tab)
Maintained by Squiblydoo
Abused code-signing certificates, with a focus on certificates sold to criminal operators.
MalwareBazaar (opens in a new tab)
Operated by abuse.ch
A code-signing certificate blocklist drawn from malware samples shared with the community.

MagicSword Research

Our research team maintains these curated lists to help you turn emerging threats into application control decisions.

Security-Tool Tampering
Tools built to disable, blind, or tamper with endpoint security products.
Exploited Code-Signing Certificates
Certificates seen signing malware in active campaigns, including compromised, expired, and revoked ones.
Windows and macOS Blocklists
Drivers, binaries, and certificates tied to known exploitation, plus macOS abuse paths such as user-writable locations, launchd, and script hosts.
Offensive and Dual-Use Tools
Security tooling that standard workstations rarely need. A file name alone is not proof of compromise, and approved security teams may need exceptions.
AI Coding Agents
Agentic tools that can run code, open shells, and read files, for teams that want to govern where they run.

Which sources are available depends on your plan. Compare plans

Community Projects

Explore the Research and Tools

Public research and practical tools from the MagicSword team. Explore vulnerable drivers, remote access, agent skills, detection rules, and ways to test your defenses.