LOLDriversTHE DRIVER THREAT CATALOG
Living Off The Land Drivers

Know the driver.
Understand the risk.

Explore vulnerable and malicious Windows drivers. Find the hashes, examine the evidence, and put detections to work.

Find a driverGet detectionsExplore tools
Recently added

ollama.sys

Elastic Security Labs reports that RONINGLOADER writes ollama.sys to a temporary directory, creates a temporary service to load it, and sends target process IDs to the driver to…

MaliciousExamine driver

The catalog at a glance

Full catalog · all known samples

Known samples

2,402

Across 699 driver entries

Driver entries over time

Cumulative driver entries over time197 entries in Jan 2023, growing to 699 in Oct 2026. Monthly totals based on the creation dates of current catalog entries.0350700Jan 2023Nov 2024Oct 2026
Oct 2026 · 699 entries+1 added

Cumulative entries · by creation date

Use the arrow keys to explore monthly totals and additions.

Driver explorer / THE CATALOG

JSONCSV
/
699 driver entries
Driver / publisherClassificationHVCI TRUESamplesAdded
ollama.sysPublisher not recordedMaliciousUnknown12026-10-01
IoDrv.sysTOPSTAR OVERSEAS ELECTRONICS Co.,LtdVulnerableUnknown12026-09-28
AToolsKrnl64.sysAntiy LabsVulnerableUnknown12026-09-23
BS_LED64.sysBIOSTAR GroupVulnerableUnknown12026-09-21
AmdTools64.sysAMDVulnerableUnknown12026-09-18
mbamchameleon.sysMalwarebytesVulnerableUnknown12026-09-18
pskmad.sysPanda Security, S.L.U.VulnerableUnknown12026-09-18
pwdrvio.sysPublisher not recordedVulnerableUnknown12026-09-18
pxscan.sysPrevxVulnerableUnknown12026-09-18
SakDriver.sysPublisher not recordedMaliciousUnknown12026-09-16
kgameprotect.sysPublisher not recordedVulnerableUnknown12026-09-11
fortimon3.sysFortinet IncVulnerableUnknown12026-09-09

Put the intelligence to work.

From a driver finding to your existing security workflow.