LOLDrivers: The Free Catalog That Tells You Which Signed Drivers Attackers Use to Kill Your EDR
bring your own vulnerable driver is the most insulting attack in the business. the adversary does not exploit your defenses, they bring a legitimately signed, Microsoft-trusted driver that happens to have a hole in it, load it, and use it to turn off your expensive endpoint agent from the kernel. the counter is unglamorous and free: a community project called LOLDrivers that catalogs every known-vulnerable and malicious driver, with hashes, so you can block them before someone uses one to blind you.
loldrivers.io, repo magicsword-io/LOLDrivers) is an open, community-maintained catalog of known-vulnerable and known-malicious Windows drivers. Each entry ships hashes, signature details, and detection content (YARA, Sigma, and WDAC policy material) so defenders can block, hunt, and detect BYOVD abuse.the problem it solves
Windows trusts signed kernel drivers. that trust is the whole security model, and it is also the weakness. over the years plenty of legitimate, signed drivers shipped with vulnerabilities that let a user-mode process read and write kernel memory, terminate protected processes, or disable security callbacks. attackers collect these, and when they land on a host they simply load a known-good-but-buggy driver and use it to switch off your EDR, your AV, and your logging from a layer most tools cannot see into.
the classic example is RTCore64.sys, the MSI Afterburner driver, which has been abused by ransomware crews for exactly this. it is signed. it is legitimate. and it will happily let a loader poke kernel memory. you cannot block it by distrusting the signature, because the signature is real. you have to block it by its hash, by name, and that means you need a list. LOLDrivers is that list.
why it matters right now
BYOVD is not a niche trick anymore. current stealer and ransomware campaigns lean on it as a standard opening move. the recently reported Lunex activity, for example, uses BYOVD to disable security monitoring before deploying a persistent stealer. that is the pattern: get on the box, load a vulnerable signed driver, kill the watchdog, then do the actual crime with nobody watching. if your detection depends entirely on an agent that BYOVD can turn off, you have a single point of failure wearing a trench coat.
using it: pull the catalog
you can clone the repo or hit the JSON API directly. the API is the fast path for automation.
curl -s https://www.loldrivers.io/api/drivers.json | jq 'length'
using it: build a blocklist
the practical move is to extract every known-vulnerable driver hash into a flat list you can feed to your EDR blocklist or convert into a WDAC policy. the repo ships detection templates so you do not have to build the WDAC policy from scratch.
curl -s https://www.loldrivers.io/api/drivers.json \
| jq -r '.[] | select(.Category|test("vulnerable")) | .KnownVulnerableSamples[].SHA256' \
| sort -u > vuln_driver_hashes.txt
using it: hunt what is already loaded
the detection side is where this earns its keep. collect the hashes of drivers loaded across your fleet, then diff against the LOLDrivers vulnerable set. any overlap is a driver that should not be there, and possibly an EDR-killing in progress.
pair it with the native control
LOLDrivers is the intelligence. the enforcement should include Microsoft’s own vulnerable driver blocklist, which is built into modern Windows and enabled by default on many configurations, plus HVCI and memory integrity where your hardware supports it. LOLDrivers gives you broader, faster-updating coverage and the hunting content; the native blocklist gives you a baseline that does not depend on you maintaining anything. run both.
the honest caveats
- it is a catalog, not a silver bullet. new vulnerable drivers get discovered constantly, so this is a feed to keep current, not a one-time import.
- blocking by hash can miss trivially repacked or newly discovered drivers. combine hash blocking with behavioral detection of suspicious kernel loads.
- test WDAC policies before you enforce them. blocking a driver your business actually needs is a great way to learn what that driver did.
BYOVD works because trust in signed code is load-bearing and attackers found the cracks in it. you are not going to out-clever a kernel-level EDR kill in real time. you prevent it by denying the tools, and LOLDrivers is the free, maintained, community-run list of exactly which tools to deny. import it, hunt with it, and stop letting a nine year old signed driver turn off the agent you pay a fortune for.
Want to know whether your fleet would actually catch a BYOVD EDR-kill, or just assume it would? Dark Edge tests the controls, not the brochure. Book a slot with Dark Edge Consulting.
