LOLDriversTHE DRIVER THREAT CATALOG
Living Off The Land Drivers

Know the driver.
Understand the risk.

Explore vulnerable and malicious Windows drivers. Find the hashes, examine the evidence, and put detections to work.

Find a driverGet detectionsExplore tools
Recently added

AToolsKrnl64.sys

Antiy ATool AToolsKrnl64.sys from the reported 2.0.26.819 package exposes process termination through IOCTL 0x99000050. Its caller check validates an Antiy-signed executable on…

VulnerableExamine driver

The catalog at a glance

Full catalog · all known samples

Known samples

2,400

Driver entries by sample count

Samples per entry

Driver explorer / THE CATALOG

JSONCSV
/
697 driver entries
Driver / publisherClassificationHVCI TRUESamplesAdded
AToolsKrnl64.sysAntiy LabsVulnerableUnknown12026-09-23
BS_LED64.sysBIOSTAR GroupVulnerableUnknown12026-09-21
AmdTools64.sysAMDVulnerableUnknown12026-09-18
mbamchameleon.sysMalwarebytesVulnerableUnknown12026-09-18
pskmad.sysPanda Security, S.L.U.VulnerableUnknown12026-09-18
pwdrvio.sysPublisher not recordedVulnerableUnknown12026-09-18
pxscan.sysPrevxVulnerableUnknown12026-09-18
SakDriver.sysPublisher not recordedMaliciousUnknown12026-09-16
kgameprotect.sysPublisher not recordedVulnerableUnknown12026-09-11
fortimon3.sysFortinet IncVulnerableUnknown12026-09-09
ampg.sysMicrosoft CorporationMaliciousUnknown12026-09-08
MemLoaderCustomize.sysPublisher not recordedMaliciousUnknown22026-09-08

Put the intelligence to work.

From a driver finding to your existing security workflow.