Skip to content
Install MCP

Threat feed

LOLDrivers Vulnerable Driver Samples

Last fetched

Malware Distribution · refreshed weekly · last verified

LOLDrivers Vulnerable Driver Samples is a Malware Distribution threat-intelligence feed, refreshed weekly, indexed by WhisperGraph.

Live data for this page is temporarily unavailable.

The graph returned an error for this lookup. Refresh in a moment to retry — fresh data is fetched on the next visit.

What is LOLDrivers Vulnerable Driver Samples

LOLDrivers Vulnerable Driver Samples catalogues signed Windows kernel drivers with known vulnerabilities or outright malicious code — "Living Off The Land Drivers" that attackers load to gain kernel-level access on systems that would otherwise block unsigned code, a technique heavily used by ransomware operators and EDR-evasion tooling (the BYOVD, Bring Your Own Vulnerable Driver, technique). The project publishes hashes, publisher certificate details, and blocklist rules (including Microsoft's own recommended driver block policy) for each entry. It is a community-maintained reference that has become a standard citation in ransomware and EDR-evasion research. It is indexed here as the canonical BYOVD-driver reference.

Source
https://www.loldrivers.io/
Refresh cadence
weekly

Indicators currently listed

Related pages

Pivot from LOLDrivers Vulnerable Driver Samples into the indicators it lists.

Queries

Resolves the feed's categories.


MATCH (f:FEED_SOURCE {name: $slug})
OPTIONAL MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
WITH f, collect(c.name) AS categories
RETURN f.name AS slug, f.id AS id, categories
Run yourself →

The indicator-kind rollup and sample listed above.


MATCH (f:FEED_SOURCE {name: $slug})<-[:LISTED_IN]-(x)
WITH labels(x)[0] AS kind, count(*) AS listed, collect(x.name)[0..5] AS sample
RETURN kind, listed, sample
ORDER BY listed DESC
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.