Threat-Driven Application Control

We Don't Block Apps.
We Block Attacker Techniques.

Traditional application control decides what software is allowed. MagicSword focuses on what attackers actually weaponize. Our threat intelligence tracks abused tools and automatically turns that research into enforcement rules across Windows, macOS, and Linux, without complex policy tuning or user disruption.

17+ INTEL FEEDS·UPDATES EVERY 2 HOURS·WINDOWS · macOS · LINUX
SIGN UP FREEBook a Demo
The Allowlisting Problem

Traditional Application ControlStarts With Guessing

Most application control platforms are built around allowlisting. Security teams attempt to decide which applications are legitimate and allow them to run. Everything else is blocked. But attackers stopped bringing their own malware. They abuse tools your organization already approved: legitimate RMM tools, vulnerable drivers, malicious certificates, and built-in OS binaries across Windows, macOS, and Linux. If those tools are already approved, the allowlist becomes the attack surface.

01Traditional Malware

Custom executables, trojans, and ransomware. Detectable by signature and hash, the era blocklists were built for.

Declining% of total attack surface
02Living Off the Land

Attackers weaponize built-in OS tools, PowerShell, WMI, certutil, mshta. No malware to detect because the tools are already trusted.

Most breachesinvolve LOLBins today
03Tool Abuse at Scale

Legitimate RMM tools, vulnerable kernel drivers, and signed admin utilities weaponized at scale. Your allowlist becomes the attack surface.

294+ RMM toolsabused by threat actors
//

82% of detections in 2025 were malware-free, attackers used legitimate tools your allowlist already approved.

SOURCE: CROWDSTRIKE 2025 GLOBAL THREAT REPORT
The Intelligence Difference

MagicSword Starts With HowAttacks Actually Happen

Instead of trying to predict what software might be safe, MagicSword tracks the tools attackers actually abuse in real breaches. When new abuse patterns appear in the wild, MagicSword translates them directly into enforcement rules. Protection evolves based on real attack behavior, not assumptions, reducing risk without disrupting operations or requiring constant policy management.

From abused binaries and vulnerable drivers to malicious certificates and dual-use tools, MagicSword tracks everything traditional EDR misses.

Living Off the Land

Built-in OS tools weaponized by attackers, PowerShell, certutil, mshta, and hundreds more across Windows, macOS, and Linux.

LOLBAS · LOOBins · GTFOBins

Vulnerable Drivers

Signed kernel drivers exploited in BYOVD attacks to disable security tools and gain kernel-level access.

LOLDrivers · Microsoft VDBL

RMM Tool Abuse

Legitimate remote monitoring tools abused for lateral movement and persistent access in enterprise breaches.

LOLRMM

Malicious Certificates

Revoked, compromised, and criminal code-signing certificates used to sign malware and bypass trust checks.

Cert Graveyard · MalwareBazaar CSCB · Actively Exploited Signers · MSFT Revoked Certs

EDR Killers

Purpose-built tools designed to disable, tamper with, or blind endpoint detection and response products.

EDR Killer Block List

Dual-Use Utilities

Legitimate admin and system tools routinely abused by attackers for credential dumping, lateral movement, and reconnaissance.

Sysinternals · NirSoft / JoeWare

17+ sources across Windows, macOS, and Linux updated every 2 hours. That research DNA powers every MagicSword policy.

The Outcome Difference

Different Intelligence Leads toDifferent Security Outcomes

Other platforms decide what software is allowed. MagicSword decides what attacker techniques are not.

Traditional Application Control

Unknown app, blocked
Trusted tool, allowed
Decide what software is safe
Build large allowlists
Continuously tune policies
Approved tools can still be abused

MagicSword Threat-Driven Control

Attacker techniques, blocked
Legitimate apps, allowed
Track tools attackers weaponize
Automatically generate deny rules
Policies evolve with real attacks
Attack techniques restricted before execution

Learn how threat-driven application control differs from traditional allowlisting approaches.

From Threat Research to Enforcement

Threat Intelligence Isthe Enforcement Engine

Other vendors license third-party feeds and call it 'threat intel.' We do the original research, and our product enforces it automatically across Windows, macOS, and Linux.

01

Discover

Team discovers new abused binaries, vulnerable drivers, malicious certificates, or dual-use tools through original security research.

02

Catalog

Cataloged across LOLBAS, LOLDrivers, and LOLRMM with full technical analysis, detection signatures, and abuse context.

03

Enforce

Findings feed directly into the MagicSword policy engine, auto-generating deny rules across Windows, macOS, and Linux with zero manual configuration.

04

Protect

Customers protected before the threat hits the news cycle. No manual policy updates. No lag between discovery and defense.

Their intel is third-party licensed or reactive. We find it first because we do the research across binaries, drivers, certificates, and tools.

Intelligence Sources

Threat Intelligence ThatBecomes Enforcement

MagicSword combines open-source and proprietary intelligence to track attacker techniques across platforms. These sources update continuously and feed directly into your WDAC policies.

SOURCE NAMETYPEPLATFORMCATEGORY
LOLBASOpen SourceWindowsLiving Off the Land
LOLDriversOpen SourceWindowsVulnerable Drivers
LOLRMMOpen SourceWindows · macOSRMM Abuse
LOOBinsOpen SourcemacOSLiving Off the Land
GTFOBinsOpen SourceLinux · macOSLiving Off the Land
MSFT Revoked CertificatesOpen SourceWindowsRevoked Certificates
Microsoft VDBLOpen SourceWindowsVulnerable Drivers
MS Recommended BlockOpen SourceWindowsApp Control Bypass
Cert GraveyardOpen SourceCross-PlatformCriminal Certificates
MagicSword macOS IntelOpen SourcemacOSThreat Hunting
PROPRIETARY / PREMIUM SOURCES
SysinternalsPremiumWindowsSystem Tools
MagicSword Intel BlocklistPremiumWindowsThreat Hunting
NirSoft / JoeWarePremiumWindowsCredential Tools
EDR Killer Block ListPremiumWindowsSecurity Evasion
Actively Exploited SignersPremiumCross-PlatformCertificate Abuse
MalwareBazaar CSCBPremiumCross-PlatformMalware Signing
17+Active Intel Sources
2hrUpdate Cadence
3Platforms CoveredWindows · macOS · Linux
<24hrNew Threat Coverage

New intel source added every quarter. Coverage expanding continuously.

Built by the Researchers Behind the Intel

The Research Behind the Product

The MagicSword founders created LOLDrivers and LOLRMM and are key maintainers of LOLBAS, the open-source projects thousands of security professionals reference daily. That research DNA powers every MagicSword policy. Explore all of our community projects.

LOLBAS

Key maintainers of the industry standard for tracking abused Windows binaries. Referenced by MITRE ATT&CK.

347+ binaries cataloged

LOLDrivers

Created the vulnerable driver database that Microsoft, CrowdStrike, and major EDR vendors reference.

892+ drivers tracked

LOLRMM

Created the definitive catalog of RMM tools abused for lateral movement in enterprise breaches.

156+ RMM tools cataloged
Spawn Control

When Attackers Lose Their Tools,They Lose Their Playbook

When PowerShell abuse is restricted, they try WMI.

When WMI is blocked, they try RMM tools.

When those paths are restricted, the attack becomes harder, slower, and more visible.

Most attackers simply move on to environments where these tools remain unrestricted. That is the goal of threat-driven application control.

Make the environment too difficult to attack.

Ready to See the Gaps?

See How MagicSword BlocksWhat Others Miss

We will audit your environment against our 17+ threat intelligence sources covering Windows, macOS, and Linux and show you the gaps your current solution leaves open.

SIGN UP FREEBOOK A DEMO

No credit card required · Deploy in 48 hours · Windows, macOS, and Linux coverage