@cyb3rbuff - Five LOOBins additions this week: trash, pbcopy, diskutil, pmset, and ldapsearch. macOS defenders now have more to work with.

Some of the latest additions to the farm🌱 @cyb3rbuff - 6 PRs on LOT Tunnels, adding iodine, ligolo-ng, Neo-reGeorg, reGeorg, dnscat2, and suo5. Tunneling section just got a lot heavier. @deFr0ggy - 2 commits on LOT Tunnels, updating Tailscale and improving the README. @YaredHenriquezB - 🥇First contribution ever: added the file createnew command to Fsutil in LOLBAS.

Episode 16 | Living off the orchard: Apple Scripts xitter.cf/i/broadcasts/1YxNrbqBr…

Most macOS security testing focuses on what attackers bring with them. @cyb3rbuff built LOAS lnkd.in/eeQVuvVr around a different question: what can an attacker do with the tools already on your Mac? The orchard has secrets. 🤐 Join us this Thursday at 2PM EST. magicsword.io/prevention-lab…

@cyb3rbuff added Tailcat to LOT Tunnels, a tool built on Tailscale's data plane that creates encrypted peer-to-peer tunnels without a control plane. github.com/LOTTunnels/LOTTun…

Episode 8 | Magic Atomics xitter.cf/i/broadcasts/1wGWjjwjL…

Same tools in every breach report for a decade. ScreenConnect. AnyDesk. Signed drivers nobody patched. The binaries Windows ships by default. Cyber security industry built LOLRMM, LOLDrivers, and LOLBAS to catalog all of it, and every year the techniques came back. Blockable. Just not being blocked by anyone. Turns out it was on us. June 9th · 2PM EST · The founders go live. 🎙️Join us: youtube.com/live/220fVOS0TEM… Register here for updates: magicsword.io/prevention-lab…

The loldrivers.io project just had its biggest month ever. 🙌 In April alone, we merged 12 PRs adding 90+ new vulnerable kernel driver entries to the database. LOLDrivers now tracks 615 unique drivers across 2,121 known vulnerable samples. Here’s what the updated security metrics dashboard shows: ✅460 samples (21.7%) load despite HVCI / Memory Integrity being enabled ✅1,523 samples (72.7%) are LOLDrivers-exclusive, meaning they are NOT covered by Microsoft’s recommended vulnerable driver blocklist ✅Only 573 samples overlap with Microsoft’s block rules That gap matters. Legitimate signed drivers from Intel, AMD, HP, Corsair, ASUS, Dell, Clevo, Beckhoff, National Instruments, and dozens of other vendors are being actively weaponized in BYOVD (Bring Your Own Vulnerable Driver) attacks. Threat actors use these drivers to disable EDR/AV, escalate privileges, and bypass kernel security controls, all with validly signed code that Windows trusts by default. ESET’s March 2026 research documented 54 EDR killers exploiting 35 vulnerable drivers. Akira and MedusaLocker ransomware operators are abusing ThrottleStop.sys. Process-kill drivers like DsArk64.sys (WHQL Microsoft-signed) can terminate PPL-protected processes with a single 4-byte IOCTL. If your organization isn’t actively managing application control policies that address vulnerable drivers, you have a significant blind spot. Tools like LOLDrivers give defenders the data they need to close it. Huge thanks to the security researchers who made this sprint possible, your contributions directly improve the defensive community’s ability to detect and block these threats. Special thanks to @weezerOSINT , @rainbowdynamix , @DbgPrint and the KeServiceDescriptorTable project. #BYOVD #LOLDrivers #WDAC #KernelSecurity #ThreatIntel #EDR #VulnerableDrivers