About Living Off The Land Drivers
Living Off The Land Drivers is a community-driven project that provides a curated list of all Windows drivers that have been found abused by adversaries to bypass security controls and execute malicious code.
The project was inspired by Michael Haag's work in hunting evil and the need to track malicious drivers that adversaries use to evade detection. Jose Enrique Hernandez is instrumental in putting the project together and continues to contribute to its development.
Browse the driver catalogA shared defensive resource
Living Off The Land Drivers is an open-source project that welcomes contributions from the security community. By sharing knowledge and expertise, we can help each other stay informed and better defend against emerging threats. Whether you're a researcher, incident responder, or system administrator, we hope that Living Off The Land Drivers will be a valuable resource in your fight against cyber attacks.
For related Living Off The Land research, visit LOLRMM, which tracks remote monitoring and management tooling abused by adversaries.
The people behind the project
Research, catalog stewardship, and detection engineering.
Michael Haag
Michael Haag co-founded MagicSword and serves as its CTO. Previously a principal threat researcher at Splunk, he brings over a decade of experience across security architecture, threat hunting, detection engineering, and complex investigations.
He helped found Atomic Red Team, LOLDrivers, and LOLRMM, and co-hosts Atomics on a Friday.
Jose Hernandez
Jose Enrique Hernandez is MagicSword's CEO and co-founder. His work centers on practical security defenses, translating attacker techniques into open-source tools and research. He previously led threat research at Splunk and co-founded Zenedge, later acquired by Oracle. His projects include Splunk Attack Range, Splunk Security Content, Git-Wild-Hunt, Melting-Cobalt, and BlackCert.
He also works as a maintainer for security industry-critical repositories such as Atomic Red Team and LOLBAS.
Nasreddine Bencherchali
Nasreddine Bencherchali works at Cisco/Splunk, focusing on detection engineering and threat hunting. Nasreddine is also one of the maintainers of the SIGMA project and the co-founder of the EVTX-ETW-Resources project. He also writes a blog about detection and other security topics.
Contribute a finding
Driver records live in YAML in the public repository. Contributions can add samples, improve metadata, or link new research and detections.