Detect vulnerable Windows drivers in MDE the right way using KQL and LOLDrivers.io. Avoid common query mistakes and boost detection accuracy.

Contribute to trailofbits/HVCI-loldrivers-check development by creating an account on GitHub.

DriverSentinel is a security tool developed in Go that detects malicious and vulnerable drivers on Windows systems by comparing them against the LOLDrivers.io database. - bI8d0/DriverSentinel

Introducing LOLDrivers 2.0: A significant milestone that refines the user experience and expands upon our comprehensive threat detection…

<div><p><a href="https://medium.com/magicswordio/loldrivers-2-0-pioneering-progress-c3b487f80489?source=rss------cybersecurity-5"><img src="https://cdn-images-1.medium.com/max/1635/1*otgFiVDYivFY73LTk6Az9A.png" width="1635" alt="1*otgFiVDYivFY73LTk6Az9A.png"></a></p><p>Introducing LOLDrivers 2.0: A significant milestone that refines the user experience and expands upon our comprehensive threat detection…</p><p><a href="https://medium.com/magicswordio/loldrivers-2-0-pioneering-progress-c3b487f80489?source=rss------cybersecurity-5">Continue reading on magicswordio »</a></p></div>

Introduction: Living Off the Land (LOTL) attacks have become the cornerstone of modern adversarial tradecraft. By weaponizing legitimate, signed binaries (LOLBins), vulnerable kernel drivers (LOLDrivers), and dual-use remote management tools (RMM), attackers can bypass traditional antivirus and EDR solutions entirely. For a U.S.-based financial services firm with 1,500 Windows endpoints and a mature security posture that already included AppLocker and WDAC, the gap wasn't a lack of tools—it was the operational burden of managing prevention at scale.

Introduction: Endpoint Detection and Response (EDR) systems are the frontline defenders in modern cybersecurity, but attackers have shifted tactics—using legitimate administrative tools and living-off-the-land binaries (LOLBins) to disable or kill EDR agents without triggering traditional alarms. MagicSword’s approach focuses on defending the EDR itself, proactively stopping “EDR killers” that exploit trusted drivers (LOLDrivers) and remote management tools (LOLRMM) before they ever execute.

Introduction: The Bring Your Own Vulnerable Driver (BYOVD) technique is a sophisticated post‑exploitation method where attackers load a legitimate but flawed kernel driver onto a system to gain Ring‑0 privileges, disable security software, and take full control. On May 8, 2026, security researcher Michael H. reported that a vulnerable Lenovo driver—CVE‑2025‑8061—had been added to the LOLDrivers database, reigniting concerns about how easily a signed driver can become an attacker’s weapon.

Introduction: Living‑Off‑the‑Land Drivers (LOLDrivers) are signed, legitimate third‑party kernel drivers that attackers repurpose to bypass security controls, disable EDRs, and gain ring‑0 persistence. The recent addition of real‑world vulnerable samples – IObitUnlocker, Zemana, and TfSysMon – to the MagicSword LOLDrivers project underscores an urgent reality: what defenders treat as benign utilities can become operational weaponry in a Bring Your Own Vulnerable Driver (BYOVD) attack.

Introduction: Bring Your Own Vulnerable Driver (BYOVD) attacks have become a preferred privilege escalation technique for ransomware gangs and advanced persistent threats (APTs). Attackers load a legitimate but vulnerable signed driver to bypass kernel protections, then exploit it to disable endpoint detection or gain SYSTEM privileges. The LOLDrivers project recently validated 84 drivers with Authenticode signatures, fixing misclassified hashes that previously confused defenders.

Introduction: Bring Your Own Vulnerable Driver (BYOVD) attacks have become a preferred weapon for ransomware gangs like Qilin, allowing them to load malicious, signed-but-flawed kernel drivers to terminate endpoint detection and response (EDR) agents. The recent discovery of Qilin’s EDR killer leveraging `rwdrv.sys` and `hlpdrv.sys` highlights the urgent need for organizations to inventory and monitor drivers—a task that the open-source LOLDrivers project has already addressed for months.

Introduction: Microsoft’s cross-signed driver policy was designed to balance compatibility with security, but attackers have weaponized legacy trust relationships. Recent LOLDrivers data reveals that nearly half of all malicious driver samples bypass Hypervisor-Protected Code Integrity (HVCI), and a single legacy driver stuck in evaluation mode can render all 1,620 known cross-signed samples loadable—meaning your “protected” endpoint is wide open. Learning Objectives: