https://www.loldrivers.io/Vulnerable and malicious Windows drivershttps://www.loldrivers.io/drivers/bd5bc879-6602-4338-938e-0873f71bd3d0/https://www.loldrivers.io/drivers/bd5bc879-6602-4338-938e-0873f71bd3d0/Tue, 08 Sep 2026 00:00:00 GMTNextron Systems identifies this exact sample as a rootkit combining network interception, obfuscated file operations, and security-product targeting. Observed and embedded filename metadata identify it as ampg.sys. Static analysis confirms WFP filtering and packet-injection paths, XOR-based file transformation, and a process-termination routine explicitly invoked for 360Tray.exe and ZhuDongFangYu.exe. Its embedded version fields claim Microsoft Corporation and SD Crashdump Port Driver; these are file metadata claims, not evidence of Microsoft authorship. No runtime test of successful security-product termination was performed.https://www.loldrivers.io/drivers/e69e3427-97cd-43bb-aeda-f1fbbeaa75f6/https://www.loldrivers.io/drivers/e69e3427-97cd-43bb-aeda-f1fbbeaa75f6/Tue, 08 Sep 2026 00:00:00 GMTNextron Systems identifies these samples as MemLoaderCustomize kernel PE-loader variants. Capabilities reported across the pair include kernel hooking, module hiding, and deletion; module hiding is specifically attributed to the c6825f94 sample. Static analysis confirms matching loader implementations that allocate image memory, copy PE sections, apply relocations, resolve kernel imports, and prepare mapped-image execution, together with file-deletion helpers. Both contain a MemLoaderCustomize.pdb build path. Module hiding and successful runtime self-deletion remain source-reported rather than dynamically tested.https://www.loldrivers.io/drivers/03d1a3a2-e76c-4fd5-a134-55ec983fdc4c/https://www.loldrivers.io/drivers/03d1a3a2-e76c-4fd5-a134-55ec983fdc4c/Tue, 08 Sep 2026 00:00:00 GMTNextron Systems identified PlugPlayService.sys as a heavily obfuscated, WHQL-signed malicious Windows kernel driver providing arbitrary memory access and direct access to RAID devices. Nextron catalogs this exact sample as an obfuscated kernel PE loader with arbitrary shellcode execution capabilities. Its embedded signature uses Microsoft Windows Hardware Compatibility Publisher. Nextron reports control-flow obfuscation similarities to RegPhantom and reports that xigmapper has deployed similar drivers; these observations do not establish that this exact sample is RegPhantom or was deployed by a particular xigmapper sample. Static analysis confirms encoded indirect calls, system-thread creation, physical-memory mapping, and enumeration of Disk driver device objects. The neonddu.sys sample has byte-identical PE sections and the same Authentihash as PlugPlayService.sys, but has a different embedded signature that fails cryptographic verification; the WHQL signing observation applies to PlugPlayService.sys, not neonddu.sys.https://www.loldrivers.io/drivers/5cbb1918-f7ac-4de8-b334-0bb4824a516b/https://www.loldrivers.io/drivers/5cbb1918-f7ac-4de8-b334-0bb4824a516b/Tue, 08 Sep 2026 00:00:00 GMTNextron Systems identifies this rksafe sample as a rootkit with input interception, anti-debugging, minifilter callbacks, and process protection. Static analysis confirms cross-process memory read/write routines, minifilter registration with a communication port, process and thread object callbacks, and logic that clears KdDebuggerEnabled. Input interception and successful runtime protection effects were not independently tested.https://www.loldrivers.io/drivers/adf27819-c7a0-4476-8632-5ca759202542/https://www.loldrivers.io/drivers/adf27819-c7a0-4476-8632-5ca759202542/Tue, 08 Sep 2026 00:00:00 GMTNextron Systems identifies this exact sample as a kernel communication and memory-access component with a covert user-to-kernel channel and privileged memory read/write. Static analysis confirms MDL-backed kernel mappings and a transfer path that probes a caller buffer and maps supplied virtual ranges in page-sized chunks. The obfuscated transfer callback was not fully resolved; the covert channel and privileged memory read/write semantics are source-reported, not independently demonstrated. The observed RzDev_00X10.sys filename does not establish vendor ownership.https://www.loldrivers.io/drivers/207b30f5-e3da-4eb2-829f-54b946eb526a/https://www.loldrivers.io/drivers/207b30f5-e3da-4eb2-829f-54b946eb526a/Mon, 31 Aug 2026 00:00:00 GMTASUS System Analysis IO release lines before 1.0.30.0 and before 3.1.41.0 are affected by CVE-2024-55408. The tracked 1.0.1.0 through 1.0.9.0 builds fall inside the affected 1.x line and expose FILE_ANY_ACCESS platform-control IOCTLs through the \Device\AsusSAIO interface. Capabilities vary by build and include PCI-derived MMIO, SMBus, I/O-port, and model-specific register operations without a caller-token authorization gate, allowing local callers to misuse privileged hardware controls.https://www.loldrivers.io/drivers/347d5d79-35e6-4438-885f-57a7c95eeb89/https://www.loldrivers.io/drivers/347d5d79-35e6-4438-885f-57a7c95eeb89/Mon, 31 Aug 2026 00:00:00 GMTAMD's ATI DSM Dynamic Driver exposes hardware-control IOCTLs through \Device\AtiDCM. The interface accepts caller-controlled MSR indexes for RDMSR operations and exposes PCI/device I/O and physical-address mapping paths. These privileged primitives can disclose hardware state and support kernel-level tampering when the device is accessible from user mode.https://www.loldrivers.io/drivers/685c38ea-6939-4b02-a250-b47dcfecf817/https://www.loldrivers.io/drivers/685c38ea-6939-4b02-a250-b47dcfecf817/Mon, 31 Aug 2026 00:00:00 GMTBiostar BSMEM64_W10 exposes direct physical-memory and port/PCI access through \Device\BSMEM. IOCTLs 0x226044 and 0x226084 map caller-selected physical addresses with MmMapIoSpace and copy data from or to the mapped region, providing arbitrary physical-memory read and write primitives.https://www.loldrivers.io/drivers/dc82ae79-d3e2-439a-a4c7-ec1f23e1261b/https://www.loldrivers.io/drivers/dc82ae79-d3e2-439a-a4c7-ec1f23e1261b/Mon, 31 Aug 2026 00:00:00 GMTFujitsu BIOS Driver versions before 2.5.0.0 are affected by CVE-2025-65001. The tracked 1.2.1.0 through 2.4.0.0 fBiosDrv.sys builds all precede the fixed release. A crafted request from a local authenticated administrator can trigger an out-of-bounds write, potentially causing arbitrary kernel code execution or denial of service.https://www.loldrivers.io/drivers/8858c9c8-e570-41ed-a5cc-054d9eb51d40/https://www.loldrivers.io/drivers/8858c9c8-e570-41ed-a5cc-054d9eb51d40/Mon, 31 Aug 2026 00:00:00 GMTTrellix HX Agent fekern.sys 34.x is affected by CVE-2025-14963. The signed FireEye 34.5.0 and 34.8.0 builds tracked here expose the \\Device\\fekern_00 interface. Used as a standalone BYOVD, the vulnerable driver can provide access to LSASS memory and enable local privilege escalation. A fully functioning HX Agent restricts access through tamper protection.https://www.loldrivers.io/drivers/9771266b-72e2-4ed3-ac14-1ac25dc5fb25/https://www.loldrivers.io/drivers/9771266b-72e2-4ed3-ac14-1ac25dc5fb25/Mon, 31 Aug 2026 00:00:00 GMTIntel Hardware Accelerated Execution Manager versions before 7.7.1 are affected by CVE-2022-21812. The tracked 6.1.0 through 7.7.0 IntelHaxm.sys builds all precede the fixed release. Improper access control on the \Device\GHAX interface allows an authenticated local user to cross the user-to-kernel security boundary and elevate privileges.https://www.loldrivers.io/drivers/1a0fab94-f4a7-48c2-a2f4-72d19c382642/https://www.loldrivers.io/drivers/1a0fab94-f4a7-48c2-a2f4-72d19c382642/Mon, 31 Aug 2026 00:00:00 GMTPGPwded.sys and eedDiskEncryptionDriver.sys are Symantec drive-encryption filters affected by CVE-2019-9702 and CVE-2019-9703. Symantec Endpoint Encryption releases before 11.3.0 and all Symantec Encryption Desktop releases are affected. The tracked filters expose raw-sector read and write controls. In the 11.1.1 eedDiskEncryptionDriver build, any-access IOCTLs 0x8002206C and 0x80022070 select a tracked volume and read or write sectors; its protected-range logic still permits writes beginning in sectors 0 through 2, leaving boot-sector modification possible.https://www.loldrivers.io/drivers/c67ad48b-223e-40f8-bfc7-0cb904d0a3d7/https://www.loldrivers.io/drivers/c67ad48b-223e-40f8-bfc7-0cb904d0a3d7/Mon, 31 Aug 2026 00:00:00 GMTPanda Kernel Memory Access Driver versions through 1.1.0.21 are affected by CVE-2023-6330, CVE-2023-6331, and CVE-2023-6332. The tracked 1.0.0.16 and 1.0.0.17 builds expose IOCTL 0xB3702C08 through \Device\PSMEMDriver. After a fixed magic value, the request accepts a process, address, and caller-controlled length without relating that length to the fixed buffered-I/O header, allowing kernel-memory disclosure and buffered-output corruption.https://www.loldrivers.io/drivers/300cdb55-6e01-4365-83e5-5783be2f9262/https://www.loldrivers.io/drivers/300cdb55-6e01-4365-83e5-5783be2f9262/Mon, 31 Aug 2026 00:00:00 GMTSUNIX Serial Driver x64 version 10.1.0.0 is affected by CVE-2024-55412. This exact signed build exposes raw I/O-port operations to low-privilege callers through IOCTLs including 0x9C403C04 and 0x9C403C08. An attacker can use the unrestricted port read/write primitives to disclose information, tamper with privileged hardware state, and elevate privileges.https://www.loldrivers.io/drivers/a07e5897-3835-4188-9e3e-bd810c3e34a5/https://www.loldrivers.io/drivers/a07e5897-3835-4188-9e3e-bd810c3e34a5/Mon, 31 Aug 2026 00:00:00 GMTWibuKey for Windows releases before 6.70 are affected by CVE-2024-45181 and CVE-2024-45182. Version 6.70 is separately affected by the boundary-validation flaw documented in WIBU-100057 and fixed in 6.71. The tracked 6.40 and 6.50a builds fall in the first affected range. In the tracked 6.70 build, subcommand 0x14 of IOCTL 0x8200E804 combines a caller-controlled offset with an input-buffer pointer without validating that the resulting object remains inside the request, enabling out-of-bounds kernel access.https://www.loldrivers.io/drivers/d2a619bb-c8c6-4c79-8b6a-8368668bbfb2/https://www.loldrivers.io/drivers/d2a619bb-c8c6-4c79-8b6a-8368668bbfb2/Mon, 31 Aug 2026 00:00:00 GMTJungo WinDriver versions 6.0.0 through 16.1.0 are affected by multiple kernel security issues fixed in version 16.2.0. The tracked 12.5.1 through 14.1.1 builds fall inside that affected interval. CVE-2024-26314 allows a low-privileged local attacker to escalate privileges and execute arbitrary code. The 14.1.1 driver exposes METHOD_NEITHER requests that reach port I/O, PCI configuration, and mapped-resource operations after the required WinDriver registration workflow.https://www.loldrivers.io/drivers/3207f14b-a66c-4d5e-a5d5-2467ffd58265/https://www.loldrivers.io/drivers/3207f14b-a66c-4d5e-a5d5-2467ffd58265/Sat, 29 Aug 2026 00:00:00 GMTThis purpose-built kernel loader creates the \\.\wifis device and accepts encrypted PE images through IOCTL 0x222000. Its worker thread decrypts input with an RC4-like routine using the embedded key dsmjklsafbv, manually maps the supplied PE image, resolves imports and relocations, and transfers execution to the unsigned payload in kernel memory.https://www.loldrivers.io/drivers/50bbae3f-f6d8-4881-8fd7-a70002d52841/https://www.loldrivers.io/drivers/50bbae3f-f6d8-4881-8fd7-a70002d52841/Sat, 29 Aug 2026 00:00:00 GMTThe 32-bit giveio driver bundled with SpeedFan creates the \\.\giveio device and handles IRP_MJ_CREATE by applying a zeroed 8 KiB I/O permission map to the opening process through Ke386IoSetAccessProcess and Ke386SetIoAccessMap. This grants unrestricted direct access to all x86 I/O ports without validating the caller.https://www.loldrivers.io/drivers/19f13965-7078-4c19-a2e3-71ab8b77a9b7/https://www.loldrivers.io/drivers/19f13965-7078-4c19-a2e3-71ab8b77a9b7/Sat, 29 Aug 2026 00:00:00 GMTHP_SWTOOLS_DRIVER exposes privileged CPU and memory operations through the \\.\HP_WKS_SWTOOLS_DRIVER device. Static analysis confirms IOCTLs for MSR read and write, performance-counter access, physical/MMIO mapping and read/write, PCI configuration access, port I/O, and a CPU-halt path. A standard user can reach the device after an administrator installs the driver.https://www.loldrivers.io/drivers/7789e9ca-8508-486b-9d77-7497c5c61474/https://www.loldrivers.io/drivers/7789e9ca-8508-486b-9d77-7497c5c61474/Sat, 29 Aug 2026 00:00:00 GMTAPSoft PCIScope's PSKD64 driver exposes memory-access operations through \\.\PSKD64. IOCTL 0x220044 dispatches sub-operations 0x701E and 0x701F for caller-selected virtual or physical memory reads and writes without constraining the target address. Public testing demonstrates arbitrary kernel read/write on Windows 11, including process protection removal and security-process termination.https://www.loldrivers.io/drivers/c7f94129-f95f-4848-b1ab-68aae24275e7/https://www.loldrivers.io/drivers/c7f94129-f95f-4848-b1ab-68aae24275e7/Fri, 28 Aug 2026 00:00:00 GMTHuorong Security identified these WHCP-signed kernel drivers in Vaultify rogueware. After a challenge-response exchange, the driver accepts a target driver name and removes process-creation callbacks registered by that driver. This strips callback-based antivirus and EDR visibility from kernel context. Public analysis reproduced the behavior in both the 32-bit and 64-bit builds.https://www.loldrivers.io/drivers/b1f406cd-117a-45bb-97db-3f9ecb44f70d/https://www.loldrivers.io/drivers/b1f406cd-117a-45bb-97db-3f9ecb44f70d/Fri, 28 Aug 2026 00:00:00 GMTThe signed SXClient sxav.sys security driver processes an SXBOOTDB boot configuration whose integrity is protected only by an unkeyed MD5 digest. Public research demonstrates that an administrator can generate a valid configuration containing arbitrary absolute paths, point the service to it, and have the kernel driver delete those files during the next boot. The primitive can be abused to remove security-product files that are otherwise locked while Windows is running.https://www.loldrivers.io/drivers/ed3abb66-c577-44b8-89fa-80d300c82373/https://www.loldrivers.io/drivers/ed3abb66-c577-44b8-89fa-80d300c82373/Fri, 28 Aug 2026 00:00:00 GMTWellbia xhunter2.sys version 2026.6.1.192 is an XIGNCODE3 anti-cheat kernel component affected by CVE-2026-15430. Public research demonstrates bypasses for its module, caller, and request authentication layers, exposing privileged command paths for cross-process memory access, protected-process handle creation, process termination, local privilege escalation, and kernel-assisted code injection.https://www.loldrivers.io/drivers/84a3007a-de5e-4622-bfc5-f05d927c3618/https://www.loldrivers.io/drivers/84a3007a-de5e-4622-bfc5-f05d927c3618/Thu, 27 Aug 2026 00:00:00 GMTAlinubx.sys exposes IOCTL 0x222024 which allows user-mode applications to terminate arbitrary processes from the kernel via ZwTerminateProcess. The IOCTL input buffer expects a structure containing the PID (DWORD) and an exit status code (DWORD). Abused by the Cruciferra MaaS loader to kill AV/EDR processes.https://www.loldrivers.io/drivers/89643454-e38b-41cb-853d-abf649a104a5/https://www.loldrivers.io/drivers/89643454-e38b-41cb-853d-abf649a104a5/Thu, 27 Aug 2026 00:00:00 GMTDCRCVDrv.sys exposes IOCTL 0x2205C0 which allows user-mode applications to terminate arbitrary processes from the kernel via ZwTerminateProcess. The IOCTL input buffer contains the PID to terminate. Abused by the Cruciferra MaaS loader, which writes the driver to C:\Windows\Temp\DCRCVDrv.sys, creates a service for it, and opens a handle via the symbolic link \\.\DCRCVDRV_U to kill AV/EDR processes.https://www.loldrivers.io/drivers/459c39a0-d6bd-4d3e-91ae-a701bb0b3198/https://www.loldrivers.io/drivers/459c39a0-d6bd-4d3e-91ae-a701bb0b3198/Wed, 12 Aug 2026 00:00:00 GMTThe driver creates a device object named "\\.\KKYUM" without strict access controls, allowing low-privileged users to interact with it. It exposes unauthenticated IOCTL control codes "0x22265C" (Read) and "0x222658" (Write) that encapsulate the MmCopyVirtualMemory kernel API. The handler accepts a target Process ID (PID) and a structured array of source/destination virtual addresses directly from user space without checking execution privileges, enabling local attackers to perform unauthorized arbitrary process memory reads and writes against any active process.https://www.loldrivers.io/drivers/8fcec30c-f5ca-4aae-b2d8-77af60b78d42/https://www.loldrivers.io/drivers/8fcec30c-f5ca-4aae-b2d8-77af60b78d42/Tue, 11 Aug 2026 00:00:00 GMTThe legacy NTPort driver creates the "\\.\zntport" device and exposes IOCTL 0xF10024CC with FILE_ANY_ACCESS. The handler accepts a caller-controlled 32-bit physical address, maps 0x32 bytes below 4 GiB with MmMapIoSpace, and copies data through an unchecked strcpy operation. After an administrator installs the driver, an unprivileged process may be able to abuse the device for physical-memory disclosure or memory corruption, depending on the device ACL.https://www.loldrivers.io/drivers/8a6aebaa-34aa-46e8-a864-4189a55fd17b/https://www.loldrivers.io/drivers/8a6aebaa-34aa-46e8-a864-4189a55fd17b/Fri, 10 Jul 2026 00:00:00 GMTktapi.sys is a legacy cross-signed Kontron Technology Application Programming Interface driver that exposes the \\.\ktapi device to user mode. IOCTL 0x82007000 accepts a caller-controlled interface type, bus address, and size before using HalTranslateBusAddress, ZwOpenSection, and ZwMapViewOfSection to map physical memory into the calling process. Certain interface types cause HalTranslateBusAddress to return the supplied address unchanged, allowing an attacker to map arbitrary system RAM for physical-memory read and write. Expel documented this primitive in an EDR-killer exploit used by The Gentlemen ransomware group to obtain kernel code execution and terminate security processes.https://www.loldrivers.io/drivers/6eca187c-8fb2-4eae-9c80-fd9ef9d8c91e/https://www.loldrivers.io/drivers/6eca187c-8fb2-4eae-9c80-fd9ef9d8c91e/Fri, 10 Jul 2026 00:00:00 GMTQIOMem.sys is the Generic IO & Memory Access driver included with Toshiba and Dynabook password utilities. It binds to ACPI\QCI0701; on systems without that firmware device, the public proof of concept creates a matching software PnP device to trigger loading of an already-installed driver package. Six IOCTLs (0x08012000 through 0x08012014) pass an unvalidated 32-bit physical address to MmMapIoSpace, allowing a low-privileged process to read or write one, two, or four bytes of physical memory below 4 GiB.https://www.loldrivers.io/drivers/c3c083d2-e9bd-4891-8582-46086de2b2b4/https://www.loldrivers.io/drivers/c3c083d2-e9bd-4891-8582-46086de2b2b4/Wed, 08 Jul 2026 00:00:00 GMTMonProcessEX.sys is a HONOR MagicAnimation and HONOR PCManager kernel driver that exposes IOCTL 0x22400C to reach ZwTerminateProcess. The device is accessible to LocalSystem and local administrators, and the process-termination path does not verify the caller, allowing an administrator-accessible client to terminate arbitrary user-mode processes except PID 0 and PID 4 from kernel mode.https://www.loldrivers.io/drivers/1db2dd90-5b8e-43c3-a39b-61e0614fb2ab/https://www.loldrivers.io/drivers/1db2dd90-5b8e-43c3-a39b-61e0614fb2ab/Thu, 25 Jun 2026 00:00:00 GMTpstrip64.sys is the EnTech Taiwan PowerStrip x64 kernel-mode driver, signed by EnTech Taiwan. In PowerStrip version 3.90.736 and earlier, the driver's IOCTL dispatcher exposes code 0x80002008, which maps caller-supplied physical memory directly into the requesting user-mode process and returns the mapped virtual base address, giving a local user an arbitrary physical read/write primitive. Public exploitation of CVE-2026-29923 uses this to scan physical memory for the EPROCESS 'Proc' pool tag, copy the SYSTEM process token, and overwrite the caller's token to escalate to NT AUTHORITY\SYSTEM.https://www.loldrivers.io/drivers/acb5da93-1dcc-4d16-8415-6b4b221cb4a1/https://www.loldrivers.io/drivers/acb5da93-1dcc-4d16-8415-6b4b221cb4a1/Mon, 22 Jun 2026 00:00:00 GMTQihoo 360netmon_wfp.sys is a signed kernel driver documented by ESET as the driver abused by the GentleKiller Network Blocker variant used in Gentlemen ransomware intrusions. The sample is associated with ESET detection Win64/VulnDriver.Qihoo360.A.https://www.loldrivers.io/drivers/6ca608ec-df2e-4a8d-8a0b-350f9e0271ab/https://www.loldrivers.io/drivers/6ca608ec-df2e-4a8d-8a0b-350f9e0271ab/Mon, 22 Jun 2026 00:00:00 GMTIObit Malware Fighter IMFForceDelete.sys is a vulnerable force-delete filter driver. ESET documents GentleKiller's Cleaner variant dropping this driver without the trailing .sys extension, and CVE-2019-6494 describes IOCTL 0x8016E000 allowing low-privileged users to delete files regardless of access controls.https://www.loldrivers.io/drivers/7d9fee48-82d8-4582-be9a-a46682054e3e/https://www.loldrivers.io/drivers/7d9fee48-82d8-4582-be9a-a46682054e3e/Mon, 22 Jun 2026 00:00:00 GMTMyPortIO_x64.sys and MyPortIO_x86.sys are Nuvoton Technology kernel drivers bundled with ASRock Polychrome RGB. Public issue #380 and the MyPortIO-Exploit writeup document unauthenticated IOCTL handlers that expose physical memory read/write and I/O port access primitives from user mode.https://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279/https://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279/Fri, 19 Jun 2026 00:00:00 GMTOPSWAT AppRemover ardrv.sys version 2017.10.02.1551 and earlier exposes a user-accessible \\.\ardrv device. Public research documents IOCTL 0x2420031 reaching process-termination paths, including ZwTerminateProcess, without sufficient caller or target validation. This allows local users to terminate arbitrary processes, including security tooling, and makes the driver useful in BYOVD-style defense impairment after it is loaded. Acronis observed the tracked ardrv.sys variant in an August 2026 campaign where it was used to terminate Microsoft Defender, Huorong, and Tencent security processes before SparkRAT deployment.https://www.loldrivers.io/drivers/2d3178da-ea76-4f36-93f4-d76bf846c240/https://www.loldrivers.io/drivers/2d3178da-ea76-4f36-93f4-d76bf846c240/Tue, 16 Jun 2026 00:00:00 GMTASRock AsrDrv107.sys and AsrDrv107n.sys are ASRock IO driver builds listed as KDU providers for ASRock Motherboard Utility versions 3.0.498 and below. The driver family is associated with CVE-2020-15368 and exposes low-level privileged access primitives used by KDU.https://www.loldrivers.io/drivers/3e3067b0-3d74-46fe-9f57-1ae3a0293958/https://www.loldrivers.io/drivers/3e3067b0-3d74-46fe-9f57-1ae3a0293958/Tue, 16 Jun 2026 00:00:00 GMTCnCrypt CcProtect.sys is a signed kernel driver used by BlackSnufkin BYOVD research as a process-killer provider. The public PoC documents this hash as a vulnerable CcProtect driver and notes that HVCI must be disabled to avoid instability.https://www.loldrivers.io/drivers/2703d3dd-05f0-4ae2-83a2-2ad0939467d0/https://www.loldrivers.io/drivers/2703d3dd-05f0-4ae2-83a2-2ad0939467d0/Tue, 16 Jun 2026 00:00:00 GMTSigned malicious drivers reported in Silver Fox activity; rwdriver.sys exposes a rootkit IOCTL primitive, while Cndom6.sys and XiaoH.sys are reported as watchdog/support drivers.https://www.loldrivers.io/drivers/18935808-e00c-4b75-a7fc-03e409a7570e/https://www.loldrivers.io/drivers/18935808-e00c-4b75-a7fc-03e409a7570e/Tue, 16 Jun 2026 00:00:00 GMTGuidance Software EnPortv.sys is an older EnCase kernel driver documented in KOSEC BYOVD research and in public reporting on signed forensic drivers used by EDR-killer tooling. KOSEC documents a KillProc IOCTL path that can terminate a target process when called from an administrator context with the expected caller PID material.https://www.loldrivers.io/drivers/271ace20-2f68-4695-9579-0d4de8cb4fe6/https://www.loldrivers.io/drivers/271ace20-2f68-4695-9579-0d4de8cb4fe6/Tue, 16 Jun 2026 00:00:00 GMTGameDriverX64.sys is a signed Hotta Studio anti-cheat driver affected by CVE-2025-61155. Its device-access and IOCTL checks rely on spoofable module names, process names, PE checksums, and the hardcoded value 0xFA123456. A local user can reach kernel routines that terminate arbitrary processes, register a process for handle protection, and strip existing handle rights. KSophon_x64.sys is the VMProtect-packed predecessor shipped with Tower of Fantasy; public reverse engineering reports that it retains the same weak authentication and IOCTL capabilities. The tracked files are legitimate vendor-signed drivers, not malicious drivers, although GameDriverX64.sys has been abused for defense evasion in ransomware intrusions.https://www.loldrivers.io/drivers/1b916d35-f62b-41ef-8454-3aed20299cb0/https://www.loldrivers.io/drivers/1b916d35-f62b-41ef-8454-3aed20299cb0/Tue, 16 Jun 2026 00:00:00 GMTKExplore.sys is Pavel Yosifovich's Kernel Explorer driver and is listed as a KDU-compatible provider. KDU uses supported provider drivers to access kernel memory primitives for actions such as process-object modification and driver mapping.https://www.loldrivers.io/drivers/8347c4af-8946-4135-b890-cde3ed35fc28/https://www.loldrivers.io/drivers/8347c4af-8946-4135-b890-cde3ed35fc28/Tue, 16 Jun 2026 00:00:00 GMTKObjExp.sys is Pavel Yosifovich's Kernel Object Explorer driver and is listed as a KDU-compatible provider. The staged samples include the KDU provider hash and a separate JobExplorer build of the same driver family.https://www.loldrivers.io/drivers/eada0015-c868-463c-91a6-d159ee1110d7/https://www.loldrivers.io/drivers/eada0015-c868-463c-91a6-d159ee1110d7/Tue, 16 Jun 2026 00:00:00 GMTKRegExp.sys is Pavel Yosifovich's Kernel Registry Explorer driver and is listed as a KDU-compatible provider. KDU uses provider drivers to perform privileged kernel operations including kernel memory access and process-object manipulation.https://www.loldrivers.io/drivers/47d4b71f-eebd-4775-9e7c-b031135e8f1b/https://www.loldrivers.io/drivers/47d4b71f-eebd-4775-9e7c-b031135e8f1b/Tue, 16 Jun 2026 00:00:00 GMTLECOMAx64.sys is a signed LECO LECOMA device driver referenced by public PPLShade supported-driver research.https://www.loldrivers.io/drivers/87680018-393b-47b6-8130-6b41bed2bc7c/https://www.loldrivers.io/drivers/87680018-393b-47b6-8130-6b41bed2bc7c/Tue, 16 Jun 2026 00:00:00 GMTLnvMSRIO.sys is a Lenovo Dispatcher driver affected by CVE-2025-8061. The tracked 3.0.2.28 through 3.1.0.36 builds predate Lenovo's fixed 3.1.0.41 driver. The WinMsrDev interface exposes physical-memory read and write through IOCTLs 0x9C406104 and 0x9C40A108 and MSR read and write through 0x9C402084 and 0x9C402088, allowing an authenticated local user to execute code with elevated privileges when Memory Integrity is not enabled.https://www.loldrivers.io/drivers/d474d8ad-14d9-4664-addd-86b4a9b7a1a5/https://www.loldrivers.io/drivers/d474d8ad-14d9-4664-addd-86b4a9b7a1a5/Tue, 16 Jun 2026 00:00:00 GMTNetEase NeacSafe64.sys is an anti-cheat mini-filter driver referenced by KDU and public NeacController research. Versions prior to 1.0.0.8 expose IOCTL/message-handler paths that provide arbitrary kernel read/write primitives and can be chained for SYSTEM privilege escalation or kernel-mode code execution.https://www.loldrivers.io/drivers/d4eb6ed4-c23f-45a9-9891-5aa8f218b863/https://www.loldrivers.io/drivers/d4eb6ed4-c23f-45a9-9891-5aa8f218b863/Tue, 16 Jun 2026 00:00:00 GMTPC-Doctor pcdsrvc_x64.sys is listed as a KDU provider for Dell PC Doctor / SupportAssist driver abuse. The driver family is associated with CVE-2019-12280 and exposes kernel access primitives used by KDU as a provider for kernel memory operations.https://www.loldrivers.io/drivers/8f2d3be4-3e25-490f-82bc-0aca16aee101/https://www.loldrivers.io/drivers/8f2d3be4-3e25-490f-82bc-0aca16aee101/Tue, 16 Jun 2026 00:00:00 GMTPC Tools PCTcore64.sys is documented by BlackSnufkin BYOVD research and CERT/CC as CVE-2026-8501. The driver creates a PCTCore device interface without restrictive access controls and exposes a process-termination IOCTL reachable by local callers.https://www.loldrivers.io/drivers/95fc9bf0-ec86-44b3-abad-a4c922aa7742/https://www.loldrivers.io/drivers/95fc9bf0-ec86-44b3-abad-a4c922aa7742/Tue, 16 Jun 2026 00:00:00 GMTIntel PMxDrv / pmxdrv64.sys is listed as a KDU provider for Intel Management Engine Tools driver abuse. Public vulnerable-driver research also documents physical-memory access through this driver family.https://www.loldrivers.io/drivers/4c9a91ff-9284-49a7-899d-dfe85a112465/https://www.loldrivers.io/drivers/4c9a91ff-9284-49a7-899d-dfe85a112465/Tue, 16 Jun 2026 00:00:00 GMTAdlice RootLaser.sys version 3.4.1 is a signed kernel driver with administrator-reachable kernel read and write primitives through IOCTLs 0x22E050 and 0x22E014. Public proof-of-concept code combines these primitives with build-specific kernel offsets to replace a process token and elevate an administrator to SYSTEM. The exploit requires offsets that match the target Windows build.https://www.loldrivers.io/drivers/0e272ccf-81e5-4612-95d2-365e7ded6eac/https://www.loldrivers.io/drivers/0e272ccf-81e5-4612-95d2-365e7ded6eac/Tue, 16 Jun 2026 00:00:00 GMTHorizon DataSys Shield drivers expose IOCTL functionality reported to provide arbitrary kernel read/write primitives.https://www.loldrivers.io/drivers/65458077-861e-4423-b446-2a9c7afe44b5/https://www.loldrivers.io/drivers/65458077-861e-4423-b446-2a9c7afe44b5/Tue, 16 Jun 2026 00:00:00 GMTThis ABYSSWORKER-related malicious kernel driver presents as Palo Alto Networks tdevflt.sys / Cortex XDR PnP Device Filter Driver. Public DragonForce reporting lists the sample in a BYOVD tradecraft set alongside known vulnerable process-killer drivers.https://www.loldrivers.io/drivers/bffcac17-f20c-43cc-baf0-93fd20bc1ed5/https://www.loldrivers.io/drivers/bffcac17-f20c-43cc-baf0-93fd20bc1ed5/Tue, 16 Jun 2026 00:00:00 GMTunknown.sys is an unattributed signed kernel driver documented in public UnknownKiller / BlackSnufkin BYOVD research. The public PoCs identify the driver as exposing a process-kill primitive suitable for BYOVD process termination research.https://www.loldrivers.io/drivers/96ba5e53-6a40-4813-b6f1-ccce31a883cf/https://www.loldrivers.io/drivers/96ba5e53-6a40-4813-b6f1-ccce31a883cf/Tue, 16 Jun 2026 00:00:00 GMTWellbia xhunter1.sys is an XIGNCODE3 anti-cheat kernel component affected by CVE-2026-3609 through version 2023.12.7.78. Public research demonstrates that its unauthenticated command channel can expose protected-process handles, read cross-process memory, terminate security processes, elevate privileges, and inject code from kernel context.https://www.loldrivers.io/drivers/767ed0a0-606b-4297-a858-e2af5b4a0400/https://www.loldrivers.io/drivers/767ed0a0-606b-4297-a858-e2af5b4a0400/Tue, 16 Jun 2026 00:00:00 GMTxkpsm.sys is an xkeeper kernel driver from JiranJikyosoft. The driver exposes IOCTL 0x8505E008 to user mode and reaches ZwTerminateProcess, enabling kernel-mediated process termination without sufficient caller or target validation. This makes the driver useful in BYOVD-style process termination and security tool impairment scenarios after it is loaded.https://www.loldrivers.io/drivers/f2032ff3-9c67-4d48-981b-2479babb153d/https://www.loldrivers.io/drivers/f2032ff3-9c67-4d48-981b-2479babb153d/Tue, 16 Jun 2026 00:00:00 GMTV-secure ZYArKit.sys version 2.0.13.5 is a signed kernel driver assessed in public KOSEC BYOVD research. KOSEC documents an IOCTL path that references a user-supplied process handle and reaches ZwTerminateProcess, allowing administrator-context termination of non-protected processes from kernel mode.https://www.loldrivers.io/drivers/5d658b45-81f0-442e-ac43-7c249ce1d54f/https://www.loldrivers.io/drivers/5d658b45-81f0-442e-ac43-7c249ce1d54f/Tue, 09 Jun 2026 00:00:00 GMTEsafeNet ProcessCtr / ProcessCtrl64.sys creates a device object reachable by local callers and exposes process-control IOCTL paths. Public research documents a vulnerable process-termination path that can allow privileged process termination or denial of service when user-supplied context/handle material is accepted without adequate authorization checks.https://www.loldrivers.io/drivers/82eee73e-156e-4344-b975-babbf0bc131f/https://www.loldrivers.io/drivers/82eee73e-156e-4344-b975-babbf0bc131f/Sat, 06 Jun 2026 00:00:00 GMTPGRHostControl.sys is a signed kernel driver distributed by FLIR Integrated Imaging Solutions, Inc. (formerly Point Grey Research). The driver exposes multiple privileged IOCTL handlers that can be accessed without sufficient authorization checks, allowing user-controlled requests to map arbitrary physical memory through \Device\PhysicalMemory and provides unrestricted I/O port read and write primitives via the x86 IN/OUT instructions. These capabilities can be abused to access physical RAM, interact directly with hardware registers, access MMIO regions, and potentially facilitate local privilege escalation or post-exploitation activity. Due to the absence of adequate access controls around highly privileged operations, the driver constitutes a Bring Your Own Vulnerable Driver (BYOVD) primitive.https://www.loldrivers.io/drivers/5b9a202c-0695-532e-9d92-662cedefee07/https://www.loldrivers.io/drivers/5b9a202c-0695-532e-9d92-662cedefee07/Mon, 01 Jun 2026 00:00:00 GMTNGStar.sys is the kernel-mode USB fingerprint sensor driver for NITGEN Fingkey Hamster II/III devices. The driver creates \Device\gstar-0 exposed as \\.\gstar-0 via IoCreateDevice with FILE_DEVICE_UNKNOWN and no IoCreateDeviceSecure call, making all 28 IOCTL codes (0x00222004-0x00222070) reachable by any unprivileged user-mode process (FILE_ANY_ACCESS on all codes). IOCTLs 0x0022206C and 0x00222070 allocate a fixed 10-byte NonPagedPool block via the deprecated ExAllocatePool API then pass it directly as the receive buffer for an uncapped USB bulk transfer with no post-transfer bounds check — kernel pool overflow leading to local privilege escalation to SYSTEM. ExAllocatePool (non-tagged, removed from Windows 11 and Server 2022 kernel exports) causes a kernel bugcheck (BSOD) on any IOCTL reaching the allocation path — confirmed local DoS. IOCTL 0x00222050 decrements a session reference counter at [rbp+0x40] via lock add without an underflow guard; counter wraps to 0xFFFFFFFF from zero, corrupting the device extension refcount and triggering premature cleanup leading to use-after-free. Driver carries no embedded PE signature; trusted via catalog fdu11.cat (VeriSign-signed, expired 2014, valid via timestamp countersignature). VT detection: 0/77.https://www.loldrivers.io/drivers/7cc0a40d-7902-4400-9fc4-0070053991cb/https://www.loldrivers.io/drivers/7cc0a40d-7902-4400-9fc4-0070053991cb/Tue, 19 May 2026 00:00:00 GMTBootRepair.sys is a legitimate Lenovo kernel driver shipped with Lenovo PC Manager (signed by LENOVO via Symantec Class 3 SHA256 Code Signing CA, compile date 2018-01-03). The driver creates a device object at \\.\BootRepair with no DACL restrictions, so any local user can open a handle. The IRP_MJ_DEVICE_CONTROL dispatcher accepts IOCTL 0x222014 with a 4-byte DWORD input (target PID) and chains PsLookupProcessByProcessId -> ObOpenObjectByPointer -> ZwTerminateProcess against the supplied PID, with no caller validation. Because the kernel-mode caller bypasses user-mode access checks, the primitive can terminate any process on the system including PPL-protected AV/EDR processes. The driver also imports ZwCreateKey / ZwSetValueKey / ZwQueryValueKey (registry access for the boot-repair feature), PsCreateSystemThread / IoRegisterShutdownNotification, and KeBugCheckEx.https://www.loldrivers.io/drivers/dbd78de7-f5ab-4fb7-a246-39cbcca4678c/https://www.loldrivers.io/drivers/dbd78de7-f5ab-4fb7-a246-39cbcca4678c/Tue, 05 May 2026 00:00:00 GMTCreate and start driverhttps://www.loldrivers.io/drivers/cb9f4425-66de-4371-a3df-3aeec1fda65c/https://www.loldrivers.io/drivers/cb9f4425-66de-4371-a3df-3aeec1fda65c/Tue, 05 May 2026 00:00:00 GMTKernel driver family observed dropped by Black Basta tooling and adjacent intrusions during 2025. The 55 KB sample is signed by Microsoft Windows Hardware Compatibility Publisher (WHQL attestation), allowing it to load on systems with HVCI enabled. Two additional 44 KB unsigned variants share the same imphash and identical/near-identical authentihashes, indicating the same driver body redistributed without the embedded signature blob. Imports include FltEnumerateFilters and FltUnregisterFilter (minifilter enumeration and unregistration), MmCopyVirtualMemory (cross-process kernel-assisted memory copy), ZwTerminateProcess and ZwOpenProcess (process termination), and KeStackAttachProcess (process attach) — primitives suitable for tamper protection or evasion of endpoint security minifilters.https://www.loldrivers.io/drivers/3599f0ef-67fc-4130-910f-0c482612d16f/https://www.loldrivers.io/drivers/3599f0ef-67fc-4130-910f-0c482612d16f/Tue, 05 May 2026 00:00:00 GMTKernel driver signed by "Fuqing Yuntan Network Tech Co.,Ltd." (a revoked VeriSign code-signing certificate that Microsoft has flagged as abused). Multiple samples in this family produce a Cobalt Strike beacon reflective loader YARA hit (Elastic protections-artifacts ruleset Windows_Trojan_CobaltStrike) and are detected by Microsoft as Trojan:Win32/Hitbrovi.G. Samples are dropped to C:\Windows under random eight-character filenames (e.g. qu829.exe) and registered as kernel services. Both observed variants share imphash ca73883db8881686fb258a9d289e3909.https://www.loldrivers.io/drivers/d4d82af5-0ac6-4d5d-944f-cf108475aba9/https://www.loldrivers.io/drivers/d4d82af5-0ac6-4d5d-944f-cf108475aba9/Thu, 30 Apr 2026 00:00:00 GMT360hvm64.sys is the kernel-mode hypervisor enforcement driver shipped with Qihoo 360 Total Security. IOCTL 0x22240c on \\.\360Hvm issues a per-CPU DPC broadcast that executes VMXOFF/VMSKINIT on every logical processor, disabling VT-x/AMD-V hypervisor protection across all CPUs; the auth gate (sub_121f4) delegates to \Device\360SelfProtection and fails open when that companion device is absent (BYOVD scenario).https://www.loldrivers.io/drivers/29d2c408-c1c6-451a-acf6-eddd59969183/https://www.loldrivers.io/drivers/29d2c408-c1c6-451a-acf6-eddd59969183/Wed, 22 Apr 2026 00:00:00 GMTAppShopDrv103.sys is a hardware utility driver from ASRock distributed with APP Shop and Auto Driver Installer. The driver exposes 30+ IOCTLs through a BCrypt AES-encrypted command wrapper (IOCTL 0x22EC00) with a hardcoded key, providing arbitrary physical memory read and write via MmMapIoSpace (IOCTLs 0x22E808/0x22E80C), unrestricted I/O port read and write in byte, word, and dword widths (IOCTLs 0x22E810-0x22E824), full PCI configuration space read and write via port 0xCF8/0xCFC (IOCTLs 0x22E830-0x22E844), MSR read and write via rdmsr/wrmsr (IOCTLs 0x22E848/0x22E84C), control register reads for CR0/CR2/CR3/CR4/CR8 (IOCTL 0x22E86C), RDTSC and RDPMC performance counter access, CPUID execution, and contiguous memory allocation. Same vulnerability class as other ASRock drivers (AsrDrv.sys) already tracked in LOLDrivers. Used by KDU (Kernel Driver Utility) as a provider.https://www.loldrivers.io/drivers/83b78b88-3b43-41cc-a60f-cab1a7b96978/https://www.loldrivers.io/drivers/83b78b88-3b43-41cc-a60f-cab1a7b96978/Wed, 22 Apr 2026 00:00:00 GMTBdApiUtil.sys is a kernel driver from Baidu Antivirus that exposes dangerous primitives to usermode with no authentication. The driver provides process termination by PID via PsLookupProcessByProcessId and ZwTerminateProcess (IOCTL 0x800024B4), process suspension via dynamically-resolved NtSuspendProcess (IOCTL 0x800024B8), full kernel registry CRUD including ZwOpenKey (0x80002190), ZwCreateKey (0x80002194), ZwSetValueKey (0x80002198), ZwDeleteKey (0x8000219C), and ZwDeleteValueKey (0x800021A0), and kernel-mode file creation via ObInsertObject/ZwCreateFile (0x80002324). The process termination primitive is exploited by the GoodBaiii EDR killer tool. Registry callback monitoring via CmRegisterCallback and process creation monitoring via PsSetCreateProcessNotifyRoutine are also present.https://www.loldrivers.io/drivers/d0cc79b2-a789-4cf3-9a88-25bdabb79416/https://www.loldrivers.io/drivers/d0cc79b2-a789-4cf3-9a88-25bdabb79416/Wed, 22 Apr 2026 00:00:00 GMTdevhost.sys is a WHQL attestation-signed kernel driver that exposes arbitrary memory read primitives to usermode. The device object at \\.\devhost has no ACL beyond a device handle. At load, the driver reads IA32_LSTAR MSR to locate ntoskrnl base via backward MZ walk, then dynamically resolves APIs (including MmMapIoSpace and MmCopyMemory) using a djb2-style hash algorithm over the PE export directory. Only 11 benign imports are visible statically. The system CR3 is leaked to user-mode at DriverEntry. Authentication uses a hardcoded magic cookie via IOCTL 0x28E017. IOCTL 0x28E01B accepts a caller-supplied CR3 and target virtual address, performs a manual 4-level x64 page-table walk (PML4-PDPT-PD-PT), and reads physical memory via MmMapIoSpace. Additional IOCTLs expose NtBuildNumber, PsLoadedModuleList, and per-CPU KPCR CurrentThread. Nextron Research noted that these primitives are tailor-made for credential theft (e.g. LSASS memory dumping), though no confirmed malicious usage has been publicly documented. WHQL attestation signed with active cert (Nov 2025-Nov 2026). SpcSpOpusInfo identifies the submitter as Shenzhen Aolian Information Security Technology Co Ltd.https://www.loldrivers.io/drivers/c2ed6a76-95ad-45fd-97d4-b55deefb3e32/https://www.loldrivers.io/drivers/c2ed6a76-95ad-45fd-97d4-b55deefb3e32/Wed, 22 Apr 2026 00:00:00 GMTGoFly64.sys is a WFP (Windows Filtering Platform) network filter driver signed by a Chinese software company (南京偲言睿网络科技有限公司 / Nanjing Siyanrui Network Technology) that exposes 20+ IOCTLs to usermode with no authentication. The most critical primitive is IOCTL 0x12227A which opens any process by PID via ZwOpenProcess and terminates it via ZwTerminateProcess, enabling kernel-level EDR/AV process killing. Additional capabilities include WFP-based network traffic interception and packet injection (FwpsInjectNetworkSendAsync, FwpsInjectNetworkReceiveAsync), IPv4 traffic redirection (IOCTL 0x122262 via RtlIpv4StringToAddressA), process creation monitoring (PsSetCreateProcessNotifyRoutineEx), image load monitoring (PsSetLoadImageNotifyRoutine), and kernel-mode file write operations. VT shows 88 malicious execution parents including malware droppers and PowerShell scripts, confirming heavy abuse in the wild for BYOVD attacks. Also distributed as PandaSpeed64.sys and drv_02581.sys.https://www.loldrivers.io/drivers/96501e5b-e4f2-41a9-a8ee-d09e36d31a39/https://www.loldrivers.io/drivers/96501e5b-e4f2-41a9-a8ee-d09e36d31a39/Wed, 22 Apr 2026 00:00:00 GMTWinIo64 is a hardware-access driver based on the WinIo library that provides direct physical-memory mapping and I/O-port operations from user mode. Its IOCTL interface exposes physical-memory map and unmap, I/O-port read and write, and physical-address translation primitives that are repeatedly incorporated into BYOVD tooling.https://www.loldrivers.io/drivers/63535f5c-9535-4bb0-ae8c-4366d40055f9/https://www.loldrivers.io/drivers/63535f5c-9535-4bb0-ae8c-4366d40055f9/Fri, 17 Apr 2026 00:00:00 GMT_xyzxbqvb.rdu_GFAC_Sys_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/1adc79ba-d923-4e25-9175-77fa18e10cad/https://www.loldrivers.io/drivers/1adc79ba-d923-4e25-9175-77fa18e10cad/Fri, 17 Apr 2026 00:00:00 GMT1109.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/54af50e5-c964-485a-9b15-d5411971a425/https://www.loldrivers.io/drivers/54af50e5-c964-485a-9b15-d5411971a425/Fri, 17 Apr 2026 00:00:00 GMT6c8a.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/deffeb8d-c7d9-46b9-a921-7d8d096460ef/https://www.loldrivers.io/drivers/deffeb8d-c7d9-46b9-a921-7d8d096460ef/Fri, 17 Apr 2026 00:00:00 GMTAIDA64Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/8dbd8d1c-aa4a-418c-9bbe-0730d37d9bb5/https://www.loldrivers.io/drivers/8dbd8d1c-aa4a-418c-9bbe-0730d37d9bb5/Fri, 17 Apr 2026 00:00:00 GMTAmd_RPMC_BiosToolCommonDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/fbd12dbb-434e-4950-887a-382b681e8a5a/https://www.loldrivers.io/drivers/fbd12dbb-434e-4950-887a-382b681e8a5a/Fri, 17 Apr 2026 00:00:00 GMTAppVkgr.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/bd06e043-0f69-4212-be93-d069bf0de848/https://www.loldrivers.io/drivers/bd06e043-0f69-4212-be93-d069bf0de848/Fri, 17 Apr 2026 00:00:00 GMTAsrCDDrv.sys is a kernel driver from ASRock Incorporation that exposes control register read/write (cr0, cr2, cr3, cr4, cr8), arbitrary MSR read/write, arbitrary physical memory read/write via MmMapIoSpace, contiguous memory allocation/free via MmAllocateContiguousMemorySpecifyCache, and I/O port read/write (8/16/32-bit). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/68810b7a-06c5-498a-bbdf-28fb4d5d9201/https://www.loldrivers.io/drivers/68810b7a-06c5-498a-bbdf-28fb4d5d9201/Fri, 17 Apr 2026 00:00:00 GMTbin_intigua_driver64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/2d301a46-ceb6-477c-8a51-463a6ded3524/https://www.loldrivers.io/drivers/2d301a46-ceb6-477c-8a51-463a6ded3524/Fri, 17 Apr 2026 00:00:00 GMTBiosToolCommonDriver.sys is an AMD RPMC (Replay Protected Monotonic Counter) field fusing utility driver that exposes 18 IOCTLs including arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O, PCI configuration space read/write, MSR read/write (wrmsr/rdmsr), SPI flash read, CPUID execution, virtual-to-physical address translation via MmGetPhysicalAddress, and contiguous memory allocation. WHQL Microsoft-signed and also AMD Sectigo dual-signed. Ships inside Razer Blade 16 BIOS update packages and ASUS firmware config bundles. PDB path confirms AMD internal build origin.https://www.loldrivers.io/drivers/5281b4b4-1b96-4261-8a1f-5fa22ba44d53/https://www.loldrivers.io/drivers/5281b4b4-1b96-4261-8a1f-5fa22ba44d53/Fri, 17 Apr 2026 00:00:00 GMTBS_RVSIO64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/9905c737-83ad-4801-a573-8267f3aea924/https://www.loldrivers.io/drivers/9905c737-83ad-4801-a573-8267f3aea924/Fri, 17 Apr 2026 00:00:00 GMTbsitf.sys and AsusBSItf.sys are ASUS BIOS Flash Driver naming variants distributed with the ASUS WinFlash utility. The 3.2.12.0 AsusBSItf.sys build exposes physical-memory reads through MmMapIoSpace (IOCTL 0x222804), contiguous kernel-memory allocation mapped to user mode through an MDL (IOCTL 0x222808), arbitrary I/O-port writes and reads (IOCTLs 0x222810 and 0x222818), and PCI configuration-space reads with BAR mapping (IOCTL 0x222814). Public research identifies this low-privilege interface as CVE-2024-33221 and demonstrates its use for privilege escalation, kernel code execution, or information disclosure. Earlier bsitf.sys builds tracked in this record additionally expose BIOS flash writes through IOCTL 0x22281C.https://www.loldrivers.io/drivers/98b064c4-c9ff-4cac-a6b6-a24964b70923/https://www.loldrivers.io/drivers/98b064c4-c9ff-4cac-a6b6-a24964b70923/Fri, 17 Apr 2026 00:00:00 GMTchinese_cheat_driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode. Public exploit research documents IOCTL 0x222000 for arbitrary kernel virtual memory reads, IOCTL 0x222018 for physical memory reads, and IOCTL 0x22201C for physical memory writes, which can be chained for local privilege escalation from an administrator context to NT AUTHORITY\SYSTEM.https://www.loldrivers.io/drivers/64601d77-61ea-43b7-8178-9d45dfba6022/https://www.loldrivers.io/drivers/64601d77-61ea-43b7-8178-9d45dfba6022/Fri, 17 Apr 2026 00:00:00 GMTCmUpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/b6873d69-affe-431b-9ba8-459391386603/https://www.loldrivers.io/drivers/b6873d69-affe-431b-9ba8-459391386603/Fri, 17 Apr 2026 00:00:00 GMTControlCenter.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/c22dd43e-cf1f-4338-a109-d662198ffbe9/https://www.loldrivers.io/drivers/c22dd43e-cf1f-4338-a109-d662198ffbe9/Fri, 17 Apr 2026 00:00:00 GMTd591004.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/6f6aedb9-aeaf-4c13-9d6d-37f062728c38/https://www.loldrivers.io/drivers/6f6aedb9-aeaf-4c13-9d6d-37f062728c38/Fri, 17 Apr 2026 00:00:00 GMTDDDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/705330b3-5e2c-4c87-ab92-0f01b68b1b2d/https://www.loldrivers.io/drivers/705330b3-5e2c-4c87-ab92-0f01b68b1b2d/Fri, 17 Apr 2026 00:00:00 GMTdddriver64Dcsa.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/f375e53d-db7c-4149-beff-c8b9329f6f9b/https://www.loldrivers.io/drivers/f375e53d-db7c-4149-beff-c8b9329f6f9b/Fri, 17 Apr 2026 00:00:00 GMTdevMemDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/843a028a-e998-42cb-874c-4478680af397/https://www.loldrivers.io/drivers/843a028a-e998-42cb-874c-4478680af397/Fri, 17 Apr 2026 00:00:00 GMTditpio64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/4e7563f0-0d77-43e9-b765-a509ba121818/https://www.loldrivers.io/drivers/4e7563f0-0d77-43e9-b765-a509ba121818/Fri, 17 Apr 2026 00:00:00 GMTDNDrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/847e6aa7-ce2d-4f4a-aa6c-a00c5f0ad728/https://www.loldrivers.io/drivers/847e6aa7-ce2d-4f4a-aa6c-a00c5f0ad728/Fri, 17 Apr 2026 00:00:00 GMTdXIw8eZ9aYxQYzgm.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/3dc0b91e-6afe-4938-ad9a-2cdf10c2c1e6/https://www.loldrivers.io/drivers/3dc0b91e-6afe-4938-ad9a-2cdf10c2c1e6/Fri, 17 Apr 2026 00:00:00 GMTEnergyDriver.sys is a kernel driver from Intel Corporation shipped with Intel Power Gadget 3.6 (deprecated December 2023). The driver exposes 5 IOCTLs including arbitrary wrmsr (any MSR index, any 64-bit value, no whitelist), arbitrary rdmsr (single CPU or all CPUs), and arbitrary physical memory read via MmMapIoSpace. wrmsr allows IA32_LSTAR hijack for direct syscall redirection. No privilege check, no MSR whitelist, default DACL. WHQL and Intel EV dual-signed.https://www.loldrivers.io/drivers/02bbc006-a4a4-438f-9b6c-4382303f6b45/https://www.loldrivers.io/drivers/02bbc006-a4a4-438f-9b6c-4382303f6b45/Fri, 17 Apr 2026 00:00:00 GMTevga_kernel_driver-x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/619953be-2115-4da2-bb59-603fcf93a3d2/https://www.loldrivers.io/drivers/619953be-2115-4da2-bb59-603fcf93a3d2/Fri, 17 Apr 2026 00:00:00 GMTfastdumpx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/f650dfc3-d3a1-4a9a-8b71-c599d1f9579c/https://www.loldrivers.io/drivers/f650dfc3-d3a1-4a9a-8b71-c599d1f9579c/Fri, 17 Apr 2026 00:00:00 GMTFDMCJHJYXZITI.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/2e47cd6a-30a2-4790-9f9c-9de7b0d7bf60/https://www.loldrivers.io/drivers/2e47cd6a-30a2-4790-9f9c-9de7b0d7bf60/Fri, 17 Apr 2026 00:00:00 GMTfjfwupgd.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/7f52f435-d217-4c13-98a4-4fdc6c8516c8/https://www.loldrivers.io/drivers/7f52f435-d217-4c13-98a4-4fdc6c8516c8/Fri, 17 Apr 2026 00:00:00 GMTFoxKeDriver64.sys is a vulnerable Foxconn kernel driver that exposes a \\.\Fox_FOXONE_Driver device. Public research documents IOCTL 0x2220C0 for translating a caller-supplied virtual address to a physical address, which can support local privilege escalation chains with other vulnerable drivers.https://www.loldrivers.io/drivers/13d67487-8c65-47bb-a3d3-d799b5f7533b/https://www.loldrivers.io/drivers/13d67487-8c65-47bb-a3d3-d799b5f7533b/Fri, 17 Apr 2026 00:00:00 GMTGGProtect64.sys is a Microsoft-signed anticheat kernel driver for GG租号 that exposes a \\.\GGProtect64 device. Public research documents a bypassable caller-registration flow through IOCTL 0x223C14 and a privileged process termination path through IOCTL 0x223C04, allowing a local process to terminate or suspend protected processes from kernel mode.https://www.loldrivers.io/drivers/1e69f91e-4ec5-4c6a-b4a4-2279808b6545/https://www.loldrivers.io/drivers/1e69f91e-4ec5-4c6a-b4a4-2279808b6545/Fri, 17 Apr 2026 00:00:00 GMTgibepext.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/90df671c-a903-49bd-ac62-c124d4f6901d/https://www.loldrivers.io/drivers/90df671c-a903-49bd-ac62-c124d4f6901d/Fri, 17 Apr 2026 00:00:00 GMTGlobalVistaVentures_v3.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/24d8bef2-379c-4a27-bd2d-4f13136f3476/https://www.loldrivers.io/drivers/24d8bef2-379c-4a27-bd2d-4f13136f3476/Fri, 17 Apr 2026 00:00:00 GMTHardwareMon-x86.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/da6709ab-3b7a-445d-9a47-e8b4141d4133/https://www.loldrivers.io/drivers/da6709ab-3b7a-445d-9a47-e8b4141d4133/Fri, 17 Apr 2026 00:00:00 GMThp64vision.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/2c7d54ff-7b49-4da8-ae77-00ac6fa2944f/https://www.loldrivers.io/drivers/2c7d54ff-7b49-4da8-ae77-00ac6fa2944f/Fri, 17 Apr 2026 00:00:00 GMTHuawei HWAuidoOs2Ec.sys is a vulnerable kernel driver from public vulnerable-driver research. Public DragonForce reporting also lists this driver in BYOVD tradecraft used to disable endpoint security tooling.https://www.loldrivers.io/drivers/79e1e3d4-36d0-4325-8d9c-c6e69b6084da/https://www.loldrivers.io/drivers/79e1e3d4-36d0-4325-8d9c-c6e69b6084da/Fri, 17 Apr 2026 00:00:00 GMTImmunetUtilDriver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/45b0de20-b3cc-4604-a428-175ea092cd39/https://www.loldrivers.io/drivers/45b0de20-b3cc-4604-a428-175ea092cd39/Fri, 17 Apr 2026 00:00:00 GMTinetcache.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/00755879-eeb3-4a70-9df6-c4e8ff561cdc/https://www.loldrivers.io/drivers/00755879-eeb3-4a70-9df6-c4e8ff561cdc/Fri, 17 Apr 2026 00:00:00 GMTiobios64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/9bf541fb-a68e-41a5-aab2-b939acc22bb1/https://www.loldrivers.io/drivers/9bf541fb-a68e-41a5-aab2-b939acc22bb1/Fri, 17 Apr 2026 00:00:00 GMTiOCdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/2ad22816-46de-45b5-999b-864944635e0a/https://www.loldrivers.io/drivers/2ad22816-46de-45b5-999b-864944635e0a/Fri, 17 Apr 2026 00:00:00 GMTIoManager.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/509edc55-1881-4fac-8640-b9c516396505/https://www.loldrivers.io/drivers/509edc55-1881-4fac-8640-b9c516396505/Fri, 17 Apr 2026 00:00:00 GMTipctype.sys is a kernel driver from Digital Electronics Corporation that exposes physical memory read/write via MmMapIoSpace. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/b898cc81-1736-45c7-ab41-c104ab17f05d/https://www.loldrivers.io/drivers/b898cc81-1736-45c7-ab41-c104ab17f05d/Fri, 17 Apr 2026 00:00:00 GMTIUForceDelete.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/b98bc8f5-5dde-417f-a25c-41d95b867d75/https://www.loldrivers.io/drivers/b98bc8f5-5dde-417f-a25c-41d95b867d75/Fri, 17 Apr 2026 00:00:00 GMTKhwmon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/56610446-9914-41f6-a028-33640a683c9d/https://www.loldrivers.io/drivers/56610446-9914-41f6-a028-33640a683c9d/Fri, 17 Apr 2026 00:00:00 GMTKinkajou.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/a6340f12-b0ee-41c5-acf0-92be886d1296/https://www.loldrivers.io/drivers/a6340f12-b0ee-41c5-acf0-92be886d1296/Fri, 17 Apr 2026 00:00:00 GMTKmWpsMs.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/ec521bd5-8a3f-46ec-b6d3-414b79977a7e/https://www.loldrivers.io/drivers/ec521bd5-8a3f-46ec-b6d3-414b79977a7e/Fri, 17 Apr 2026 00:00:00 GMTl1malwarebits.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/50de2fce-d9b5-4007-abef-22560e4e93b2/https://www.loldrivers.io/drivers/50de2fce-d9b5-4007-abef-22560e4e93b2/Fri, 17 Apr 2026 00:00:00 GMTLallamon.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/430f94b4-69e8-4541-bea7-329be7d283b7/https://www.loldrivers.io/drivers/430f94b4-69e8-4541-bea7-329be7d283b7/Fri, 17 Apr 2026 00:00:00 GMTlsigetwin_SliffDriver.sys is a Microsoft-signed vulnerable kernel driver that exposes a \\.\SliffDriver device. Public research documents IOCTL 0x80002004 for mapping caller-supplied physical memory into user mode, enabling local privilege escalation when chained with kernel address discovery and virtual-to-physical translation primitives.https://www.loldrivers.io/drivers/ae2a6048-3896-4dd8-9eb1-a4a66104b0cf/https://www.loldrivers.io/drivers/ae2a6048-3896-4dd8-9eb1-a4a66104b0cf/Fri, 17 Apr 2026 00:00:00 GMTMemCtl.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/24cc4f8d-a88d-4b2d-a912-bc773d12a524/https://www.loldrivers.io/drivers/24cc4f8d-a88d-4b2d-a912-bc773d12a524/Fri, 17 Apr 2026 00:00:00 GMTMnemosyne.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/0e94f1a2-beab-4adb-9687-eb2719a201c9/https://www.loldrivers.io/drivers/0e94f1a2-beab-4adb-9687-eb2719a201c9/Fri, 17 Apr 2026 00:00:00 GMTmst.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/b7bfe661-591a-45be-823d-ac6dae2edeed/https://www.loldrivers.io/drivers/b7bfe661-591a-45be-823d-ac6dae2edeed/Fri, 17 Apr 2026 00:00:00 GMTmtxC9CB.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/7c766ce5-fa74-4080-907d-95f2f68d49e7/https://www.loldrivers.io/drivers/7c766ce5-fa74-4080-907d-95f2f68d49e7/Fri, 17 Apr 2026 00:00:00 GMTmtxmem.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/0e114b5b-7ec1-4fa3-ac93-e505f986547f/https://www.loldrivers.io/drivers/0e114b5b-7ec1-4fa3-ac93-e505f986547f/Fri, 17 Apr 2026 00:00:00 GMTNetworkLocker_x64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/c7789f3c-b638-4f66-a890-7605682306e7/https://www.loldrivers.io/drivers/c7789f3c-b638-4f66-a890-7605682306e7/Fri, 17 Apr 2026 00:00:00 GMTNovawave_Novabench_NovabenchDriverWin10.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/cf9ed92d-d39b-4562-a256-b36f6560ccfa/https://www.loldrivers.io/drivers/cf9ed92d-d39b-4562-a256-b36f6560ccfa/Fri, 17 Apr 2026 00:00:00 GMTNPR0.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/6f1d7635-0778-4f17-9c97-b80deca32510/https://www.loldrivers.io/drivers/6f1d7635-0778-4f17-9c97-b80deca32510/Fri, 17 Apr 2026 00:00:00 GMTnxeng.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/3a56286a-d6e2-4782-bd43-1e04869da8cc/https://www.loldrivers.io/drivers/3a56286a-d6e2-4782-bd43-1e04869da8cc/Fri, 17 Apr 2026 00:00:00 GMTOAToolx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/90239ca5-500d-422a-a3e6-6b771b55b3eb/https://www.loldrivers.io/drivers/90239ca5-500d-422a-a3e6-6b771b55b3eb/Fri, 17 Apr 2026 00:00:00 GMTp2KGhmzsARY1.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/ec5012bb-789a-436d-be22-b343c331f7c7/https://www.loldrivers.io/drivers/ec5012bb-789a-436d-be22-b343c331f7c7/Fri, 17 Apr 2026 00:00:00 GMTPMAD.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/84f92ac1-1e72-420d-9cc0-65c838b90a4d/https://www.loldrivers.io/drivers/84f92ac1-1e72-420d-9cc0-65c838b90a4d/Fri, 17 Apr 2026 00:00:00 GMTportwell.sys is a kernel driver from Portwell Inc. (Taiwan) that exposes physical memory read/write via MmMapIoSpace. Portwell manufactures embedded computing platforms and industrial PCs. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/d6dc9b52-9918-442d-b03a-f1f614aa4cce/https://www.loldrivers.io/drivers/d6dc9b52-9918-442d-b03a-f1f614aa4cce/Fri, 17 Apr 2026 00:00:00 GMTppa_x64.sys is a kernel driver by Remko Weijnen that provides physical memory access via the PhysicalMemory section object. The device name PhyMem indicates this is part of the PhyMem driver family, of which several variants are already tracked in LOLDrivers (phymem64.sys, Phymemx64.sys, phymem_ext64.sys). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/6882f954-e69b-464a-b7cf-0cda802d3257/https://www.loldrivers.io/drivers/6882f954-e69b-464a-b7cf-0cda802d3257/Fri, 17 Apr 2026 00:00:00 GMTRealtime Driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/610617d5-2566-4f55-b636-29a4ea576654/https://www.loldrivers.io/drivers/610617d5-2566-4f55-b636-29a4ea576654/Fri, 17 Apr 2026 00:00:00 GMTRtsTpx.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/f1dd9c41-2608-48e5-bb3e-191d56b34591/https://www.loldrivers.io/drivers/f1dd9c41-2608-48e5-bb3e-191d56b34591/Fri, 17 Apr 2026 00:00:00 GMTsdrv_win_sliff.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/028aecb5-70d0-4423-87d7-f037a11ef1c9/https://www.loldrivers.io/drivers/028aecb5-70d0-4423-87d7-f037a11ef1c9/Fri, 17 Apr 2026 00:00:00 GMTsigneddrv.sys is a Microsoft-signed vulnerable kernel driver that exposes an unrestricted \\.\WinNotify device. Public research documents IOCTL 0x22200C for kernel base disclosure, IOCTL 0x222040 for arbitrary kernel read, and IOCTL 0x222044 for arbitrary kernel write, enabling local privilege escalation.https://www.loldrivers.io/drivers/47e08b2f-7925-40c5-9bcf-0af348c07d33/https://www.loldrivers.io/drivers/47e08b2f-7925-40c5-9bcf-0af348c07d33/Fri, 17 Apr 2026 00:00:00 GMTSIOCTL.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/9720d49d-c20f-479e-9284-2b3ad120fdf8/https://www.loldrivers.io/drivers/9720d49d-c20f-479e-9284-2b3ad120fdf8/Fri, 17 Apr 2026 00:00:00 GMTSONiXDDRx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/2a9193cc-4e7e-4c8d-9cb4-040723e81841/https://www.loldrivers.io/drivers/2a9193cc-4e7e-4c8d-9cb4-040723e81841/Fri, 17 Apr 2026 00:00:00 GMTSparkIO.sys is a WHQL-signed kernel driver from Clevo Co. (Taiwan ODM) that ships with Control Center 3.0 and Flexicharger utilities on Clevo-chassis laptops (XMG, Eluktronics, EVOO, Origin PC, System76, Sager, and others). CVE-2022-37415 (CVSS 7.8) documents an out-of-bounds write vulnerability. The driver exposes arbitrary physical memory read via MmMapIoSpace, unrestricted I/O port read/write, arbitrary PCI configuration space read/write, and SMBus/I2C read/write. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation. A public PoC exists by alfarom256.https://www.loldrivers.io/drivers/5c4142a6-b287-4817-864f-152be08f7c48/https://www.loldrivers.io/drivers/5c4142a6-b287-4817-864f-152be08f7c48/Fri, 17 Apr 2026 00:00:00 GMTsrswdrv.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/8d2f15a5-e71a-47ba-a391-55d1a1962368/https://www.loldrivers.io/drivers/8d2f15a5-e71a-47ba-a391-55d1a1962368/Fri, 17 Apr 2026 00:00:00 GMTSvIoCtrlx64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/1ce0aa79-8719-447c-908b-75547f2ccc98/https://www.loldrivers.io/drivers/1ce0aa79-8719-447c-908b-75547f2ccc98/Fri, 17 Apr 2026 00:00:00 GMTSysFile_X64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/1dd9bcd1-0090-4561-bfc4-481c3d139c81/https://www.loldrivers.io/drivers/1dd9bcd1-0090-4561-bfc4-481c3d139c81/Fri, 17 Apr 2026 00:00:00 GMTSysInfoX64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/408964b3-1799-425b-92bf-465c72a272d1/https://www.loldrivers.io/drivers/408964b3-1799-425b-92bf-465c72a272d1/Fri, 17 Apr 2026 00:00:00 GMTTBT_Force_Power_Control_Access64.sys is a Thunderbolt force power control driver from Wistron Corporation that exposes physical memory read/write via MmMapIoSpace. Wistron is a major Taiwan-based OEM/ODM. Another Wistron driver (WiRwaDrv.sys) is already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/886af494-4087-48c9-b48f-53e638d6f62e/https://www.loldrivers.io/drivers/886af494-4087-48c9-b48f-53e638d6f62e/Fri, 17 Apr 2026 00:00:00 GMTUDDB2B6.sys is a TechPowerUp kernel driver (GPU-Z variant) that exposes I/O port read/write, MSR read/write, MmMapIoSpace map/unmap/read/write, and PCI configuration space read/write. TechPowerUp has a history of vulnerable kernel drivers including GPU-Z.sys (CVE-2019-7245, CVE-2025-5324) and ThrottleStop.sys (CVE-2025-7771). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/549d3563-74ce-4d84-844c-8d985886373c/https://www.loldrivers.io/drivers/549d3563-74ce-4d84-844c-8d985886373c/Fri, 17 Apr 2026 00:00:00 GMTwatabe.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/894bd2db-1d93-4b3d-8e4d-7dac29382cb9/https://www.loldrivers.io/drivers/894bd2db-1d93-4b3d-8e4d-7dac29382cb9/Fri, 17 Apr 2026 00:00:00 GMTwdisvhost.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/c366ee89-97ae-4523-b635-e05769384bd3/https://www.loldrivers.io/drivers/c366ee89-97ae-4523-b635-e05769384bd3/Fri, 17 Apr 2026 00:00:00 GMTwhql.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/52955eb1-8cf4-41f3-b998-5e2e6d3aa258/https://www.loldrivers.io/drivers/52955eb1-8cf4-41f3-b998-5e2e6d3aa258/Fri, 17 Apr 2026 00:00:00 GMTWindows_CPU_Temperature_Component.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/e354b869-e817-4f9f-8027-a3d5bfb3689b/https://www.loldrivers.io/drivers/e354b869-e817-4f9f-8027-a3d5bfb3689b/Fri, 17 Apr 2026 00:00:00 GMTWindows-Memory-Informer.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.https://www.loldrivers.io/drivers/d0de6c54-2dd8-4e32-a2a7-c6c26dcd2a0f/https://www.loldrivers.io/drivers/d0de6c54-2dd8-4e32-a2a7-c6c26dcd2a0f/Fri, 17 Apr 2026 00:00:00 GMTXLHA.sys is a kernel driver from LG Electronics Inc. that exposes physical memory read/write via MmMapIoSpace and MSR read. Two other LG LHA.sys variants are already tracked in LOLDrivers. The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.https://www.loldrivers.io/drivers/658a906e-82d3-4c78-a63b-ddddeeb3f452/https://www.loldrivers.io/drivers/658a906e-82d3-4c78-a63b-ddddeeb3f452/Mon, 13 Apr 2026 00:00:00 GMTAdvCare.sys is a legacy hardware health monitor driver from Advantech Co., Ltd. for industrial PCs and embedded boards. The driver exposes arbitrary MSR read/write (wrmsr/rdmsr with no validation), arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O across all 65536 ports, and PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation -- no admin check, no token check, no integrity check. Any unprivileged local user can open the device and invoke every primitive. The driver is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.https://www.loldrivers.io/drivers/97e3077a-ca57-4f45-ba7c-f63dc9c4ea32/https://www.loldrivers.io/drivers/97e3077a-ca57-4f45-ba7c-f63dc9c4ea32/Mon, 13 Apr 2026 00:00:00 GMTCardIo64.sys is a kernel driver from ICP DAS Co., LTD. (Taiwan), an industrial automation and I/O board manufacturer. The driver exposes arbitrary physical memory read/write via MmMapIoSpace, port I/O read/write (8/16/32-bit), and PCI bus data read/write via HalGetBusDataByOffset and HalSetBusDataByOffset. The driver is only 13KB and is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.https://www.loldrivers.io/drivers/e41d5471-c4b8-48da-bdb7-e462008c2e78/https://www.loldrivers.io/drivers/e41d5471-c4b8-48da-bdb7-e462008c2e78/Mon, 13 Apr 2026 00:00:00 GMTcpqsysio64.sys is a Hewlett-Packard physical-memory driver distributed with ProLiant support and firmware utilities. The tracked 4.5.0.0 and 4.6.0.0 builds handle IOCTL 0x152EF0 by accepting a caller-supplied physical address and length, mapping that range with MmMapIoSpace, and copying from it without constraining the requested physical range. An administrator with device access can read arbitrary physical memory, disclose kernel-sensitive data, and recover addresses that undermine kernel address randomization.https://www.loldrivers.io/drivers/399fb787-5b06-46f0-86cb-dff7374bb015/https://www.loldrivers.io/drivers/399fb787-5b06-46f0-86cb-dff7374bb015/Mon, 13 Apr 2026 00:00:00 GMTDsArk64.sys is a WHQL Microsoft-signed anti-rootkit kernel driver from Qihoo 360 Total Security. It exposes kernel-level process termination via ZwTerminateProcess from Ring 0 (kills PPL-protected processes), arbitrary kernel memory read (512 bytes), and arbitrary kernel memory write (32 bytes). The driver gates device access behind a custom Authenticode signing check that validates the calling process PE signature against Qihoo root certificates. This check is fully bypassed via process hollowing into any Qihoo-signed executable (freely downloadable from 360.cn). The process kill IOCTL (0x80863008) requires no encryption or additional auth beyond the device open -- just a raw 4-byte PID. The kernel R/W IOCTLs use AES-128-CBC with a static key embedded in the binary. Initialization requires setting registry key HKLM\SYSTEM\CCS\Services\360FsFlt\daboot to 1.https://www.loldrivers.io/drivers/a2177b22-0401-4c31-8ae4-40a7e2a53653/https://www.loldrivers.io/drivers/a2177b22-0401-4c31-8ae4-40a7e2a53653/Mon, 13 Apr 2026 00:00:00 GMTdtr_ec.sys is a Dell kernel driver that ships as part of the Dell Feature Enhancement Pack (DFEP) on Dell laptops and desktops. The driver provides unrestricted read/write access to Embedded Controller (EC) registers across 5 ACPI address spaces from usermode with no validation on the register addresses or values. The Embedded Controller manages critical hardware functions including thermal management, battery charging, fan control, power states, and keyboard input. Unrestricted EC register access allows manipulation of thermal thresholds to cause hardware damage or forced shutdowns, modification of fan speed controls, interference with battery charging logic, and alteration of power management behavior. Dell PSIRT has confirmed the vulnerability and triaged it as P2 severity on Bugcrowd.https://www.loldrivers.io/drivers/a6dd3aef-d3a7-4c72-abcd-e633e0c0706c/https://www.loldrivers.io/drivers/a6dd3aef-d3a7-4c72-abcd-e633e0c0706c/Mon, 13 Apr 2026 00:00:00 GMTkdhacker64_ev.sys is a kernel driver from Beijing Kingsoft Security software bundled with Kingsoft AntiVirus and Liebao Browser. The driver exposes a kernel heap buffer overflow via IOCTL 0x120140 with approximately 512 bytes of overflow into adjacent kernel pool allocations. The root cause is a size validation mismatch -- input is validated at 0x488 bytes per element but only 0x248 bytes are allocated per element. RtlInitUnicodeString is called on user-controlled buffers without null terminator bounds checking, producing oversized ANSI strings that overflow 64-byte destination buffers. No authentication is required to access the device. The driver also includes TDI hooks for TCP/UDP/RawIP interception, process creation notification callbacks, filesystem filter attachments to NTFS/FAT/CDFS, camera device monitoring, and HTTP header parsing. Other Kingsoft drivers (ksapi.sys, mydrivers.sys) are already tracked in LOLDrivers.https://www.loldrivers.io/drivers/08fbd284-7ad2-466d-b55f-6d5a7d07aca5/https://www.loldrivers.io/drivers/08fbd284-7ad2-466d-b55f-6d5a7d07aca5/Fri, 10 Apr 2026 00:00:00 GMTArgusMonitor.sys is the kernel driver for the Argus Monitor hardware temperature monitoring and fan control application by Argotronic UG (Germany). The driver exposes 47 IOCTLs providing arbitrary physical memory read/write via MmMapIoSpace (32 map slots, up to 128KB) with a single-shot read primitive that bypasses the address restriction (busNum=0xFF), unrestricted port I/O (any port 0x0000-0xFFFF), PCI configuration space read/write via HalGetBusDataByOffset and HalSetBusDataByOffset, MSR read/write with a whitelist that blocks IA32_LSTAR but allows IA32_MISC_ENABLE write (can disable NX/XD system-wide), and I2C/SMBus access via MMIO bit-banging. The driver uses IoCreateDevice with no DACL and IRP_MJ_CREATE returns STATUS_SUCCESS immediately with no caller validation. A handshake IOCTL accepts a user-chosen 0x200-byte XOR keypad (sending all zeros effectively disables the XOR layer). WHQL attestation signed with an active Microsoft certificate. KASLR bypass confirmed via physical memory PE header scan. Loads on any x64 Windows without ArgusMonitor software.https://www.loldrivers.io/drivers/5904f3a1-2e0c-4746-8078-8ada66a5cb08/https://www.loldrivers.io/drivers/5904f3a1-2e0c-4746-8078-8ada66a5cb08/Fri, 10 Apr 2026 00:00:00 GMTASTRA64.sys is the kernel driver for the ASTRA32 system information tool by Sysinfo Lab (EnTech Taiwan). The driver exposes 31 IOCTLs with zero validation on all parameters including arbitrary physical memory read/write via ZwOpenSection and ZwMapViewOfSection on Device\PhysicalMemory with PAGE_READWRITE, arbitrary port I/O via HalTranslateBusAddress, arbitrary MSR read via rdmsr (enables KASLR bypass via IA32_LSTAR), PCI configuration space read via HalGetBusDataByOffset, and MMIO physical memory mapping via MmMapIoSpace. No authentication gate, no DACL restrictions (plain IoCreateDevice). Loads on any x64 Windows system. EnTech Taiwan also produces TVicPort and softEngine drivers which share similar low-level hardware access patterns. Listed in Eclypsium Screwed-Drivers research.https://www.loldrivers.io/drivers/5ff0ca63-fff8-4c2d-ac04-bb09fc84259f/https://www.loldrivers.io/drivers/5ff0ca63-fff8-4c2d-ac04-bb09fc84259f/Fri, 10 Apr 2026 00:00:00 GMTnipalk.sys is the NI-PAL core kernel driver. The tracked 18.0.0f0 build is within NI-PAL versions before 20.0.1f0 affected by CVE-2021-38304, where improper input validation can allow a local user to escalate privileges. The separately tracked 25.8 build is not attributed to that CVE; exact analysis of that build found physical-memory mapping, virtual-to-physical translation, DMA allocation, bus access, and PCI configuration operations reachable through its IOCTL service gateway.https://www.loldrivers.io/drivers/fc3467c3-6109-447d-b438-7a4276c3d8e5/https://www.loldrivers.io/drivers/fc3467c3-6109-447d-b438-7a4276c3d8e5/Fri, 10 Apr 2026 00:00:00 GMTA Microsoft-signed vulnerable driver used in BYOVD attacks to terminate protected processes, including EDR solutions such as CrowdStrike Falcon. The driver exposes an IOCTL that allows arbitrary process termination from user mode by passing a PID.https://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/https://www.loldrivers.io/drivers/12998ebb-8c74-4e44-89a2-2a71c0f6e92b/Fri, 10 Apr 2026 00:00:00 GMTTcIo.sys and TcRouter.sys are WHQL Microsoft-signed kernel drivers from Beckhoff Automation GmbH (TwinCAT 3 Industrial Automation Runtime). TcIo.sys exposes arbitrary physical memory read/write via ZwOpenSection on Device\PhysicalMemory, arbitrary MMIO mapping via MmMapIoSpace, PCI configuration space read/write via HalGetBusDataByOffset and HalSetBusDataByOffset, and full PCI BAR probing and mapping. TcRouter.sys exposes arbitrary port I/O via direct ring-0 in/out instructions. Both drivers use plain IoCreateDevice with no DACL and have no caller validation on IRP_MJ_CREATE. All IOCTLs use METHOD_NEITHER with FILE_ANY_ACCESS. No hardware gate -- drivers load on any x64 Windows without Beckhoff hardware. CVE-2018-7502 was assigned for an untrusted pointer dereference in IOCTL 0x222206 affecting 19 drivers in the TwinCAT family (CISA advisory ICSA-18-081-02, Source Incite SRC-2018-0007). The physical memory and port I/O primitives described here go beyond the scope of CVE-2018-7502. 18 related drivers share the same codebase and certificate.https://www.loldrivers.io/drivers/f0a02666-44f6-4174-a7c6-d006481a340f/https://www.loldrivers.io/drivers/f0a02666-44f6-4174-a7c6-d006481a340f/Tue, 07 Apr 2026 00:00:00 GMTTRIXX.sys is a shared utility kernel driver distributed by TechPowerUp LLC with Sapphire TRIXX and GPU-Z. The driver provides completely unrestricted hardware access from usermode through 16+ IOCTLs with zero validation on hardware parameters, including arbitrary port I/O read/write, arbitrary PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset, MMIO BAR mapping via MmMapIoSpace, and MMIO read/write through mapped BARs. Physical memory read/write is achievable by remapping a PCI device BAR to a target physical address then mapping it via MmMapIoSpace. The driver creates its device dynamically based on the Windows service name and has no hardware dependency, loading on any x64 Windows system. TechPowerUp has a history of vulnerable kernel drivers including GPU-Z.sys (CVE-2019-7245, CVE-2025-5324) and ThrottleStop.sys (CVE-2025-7771) which expose the same MmMapIoSpace primitive. Fresh EV code signing certificate valid until April 2028 with zero AV detections.https://www.loldrivers.io/drivers/08adabb3-7336-43de-a980-e23a55081f19/https://www.loldrivers.io/drivers/08adabb3-7336-43de-a980-e23a55081f19/Tue, 07 Apr 2026 00:00:00 GMTWDTKernel.sys is a Dell Watchdog Timer Kernel Driver that exposes 12 IOCTLs for arbitrary physical memory read/write via MmMapIoSpace with zero validation on user-supplied physical addresses. It also provides 12 IOCTLs for unrestricted I/O port access and 2 IOCTLs for PCI configuration space access. The driver was WHQL attestation signed through Microsoft and is distributed via the Microsoft Update Catalog. VMware Carbon Black TAU mentioned this driver in their October 2023 research but classified it as not vulnerable in terms of access control because its INF sets an SDDL restricting device access to Administrators and SYSTEM. The arbitrary physical memory R/W via MmMapIoSpace was not analyzed or documented by TAU. Device path is \\.\__WDT__. Suitable for BYOVD attacks where the attacker already has admin privileges and needs kernel-level memory access to bypass EDR.https://www.loldrivers.io/drivers/a7c3e2d1-8f4b-4e6a-b5d9-3c1f0e7a9b82/https://www.loldrivers.io/drivers/a7c3e2d1-8f4b-4e6a-b5d9-3c1f0e7a9b82/Mon, 06 Apr 2026 00:00:00 GMTTeledyne Digital Imaging CorMem.sys (Sapera Memory Manager) exposes physical memory read/write, contiguous memory allocation, and I/O port access to user-mode processes via CorMem.dll wrapper functions. The driver provides 36 exported functions including CorMemGetPhysMemory, CorMemMapPhysMemory, CorMemAllocPhysMemory, CorMemReadIo, and CorMemWriteIo. Actively abused for BYOVD with 0/71 VT detection. Execution parents include Cobalt Strike/IcedID malware and game cheat kernel loaders.https://www.loldrivers.io/drivers/741677e9-20d5-40e5-9cd2-3bf2beb76322/https://www.loldrivers.io/drivers/741677e9-20d5-40e5-9cd2-3bf2beb76322/Mon, 06 Apr 2026 00:00:00 GMTET&T Technology Co., Ltd. dpmemio.sys (ClevoECView) is a 12KB driver with only 9 imports that provides completely unrestricted arbitrary physical memory read/write and I/O port access with no authentication, no ACL, no address validation, and no size validation. MmUnmapIoSpace is not even imported, meaning every MmMapIoSpace call permanently leaks a system PTE mapping. An additional bug exists where MOVSXD sign-extension on a 32-bit UserBufferPtr provides a write-to-kernel-VA primitive. IOCTLs exposed via \\.\dpMemIO include 0xC80A2420 (arbitrary physical memory READ via MmMapIoSpace), 0xC80A2424 (arbitrary physical memory WRITE via MmMapIoSpace), 0xC80A2410/0xC80A2414 (I/O port read/write byte), 0xC80A2418/0xC80A241C (I/O port read/write variable size), and 0xC80A2428 (version/ping). VeriSign signed with a revoked certificate.https://www.loldrivers.io/drivers/b3f7c8d2-4a19-4e5b-9d6c-2f8e1a3b7c04/https://www.loldrivers.io/drivers/b3f7c8d2-4a19-4e5b-9d6c-2f8e1a3b7c04/Mon, 06 Apr 2026 00:00:00 GMTCYBELSOFT DriversCloud_amd64.sys exposes 7 IOCTLs with no access checks and a zero security descriptor on the device object, meaning any user (including low-integrity processes) can open a handle. Primitives include arbitrary physical memory read via MmMapIoSpace (up to 2MB per call), arbitrary MSR read/write (including IA32_LSTAR for instant kernel code execution), arbitrary I/O port read/write, and arbitrary PCI configuration space read/write. A full LSTAR hijack PoC with crash-safe ROP restore has been demonstrated. The developer acknowledged the issue and is working on a rewritten driver.https://www.loldrivers.io/drivers/31439f28-4616-4ee1-a6b7-1cf742127909/https://www.loldrivers.io/drivers/31439f28-4616-4ee1-a6b7-1cf742127909/Mon, 06 Apr 2026 00:00:00 GMTRay Hinchliffe SIV (System Information Viewer) SIVX64.sys v5.85 dynamically resolves MmMapIoSpace and MmMapIoSpaceEx via MmGetSystemRoutineAddress at runtime (neither appears in the IAT), evading static import-based scanning. The driver exposes multiple privileged IOCTL primitives via \\.\SIVDRIVER including arbitrary physical memory mapped read/write (Cmd 0x14, critical), physical memory read via scatter-gather (Cmd 0x10) and bulk MDL (Cmd 0x13), MSR read/write on a whitelisted subset (Cmd 0x08/0x0C), unrestricted I/O port read/scan (Cmd 0x44/0x50), and unrestricted PCI configuration space read (Cmd 0x48). WHQL signed by Microsoft Windows Hardware Compatibility Publisher; loads despite HVCI.https://www.loldrivers.io/drivers/57822c56-6531-4a2e-afbf-96f77dc5fcaf/https://www.loldrivers.io/drivers/57822c56-6531-4a2e-afbf-96f77dc5fcaf/Thu, 26 Mar 2026 00:00:00 GMTKslD.sys is a Microsoft-signed Windows Defender support driver that can be abused for kernel memory access after its SharedState process-name check is redirected to an attacker-controlled process. Public research documents IOCTL 0x222044 as exposing physical and virtual memory read primitives that can support KASLR bypass, token discovery, and LSASS/PPL bypass workflows.https://www.loldrivers.io/drivers/f4e00816-97a8-4c2d-b990-9812f16fe3d3/https://www.loldrivers.io/drivers/f4e00816-97a8-4c2d-b990-9812f16fe3d3/Fri, 20 Mar 2026 00:00:00 GMTAhnLab kernel driver exposing arbitrary physical memory read/write via IOCTL 0x81000000. Device accessible at \\.\ATHpEx. Signed by AhnLab Inc. with VeriSign certificate (first seen 2014). Zero detections (0/73) on VirusTotal but exploitable for privilege escalation by mapping attacker-controlled physical memory into kernel address space.https://www.loldrivers.io/drivers/6c84d133-c619-4deb-a91a-5cf05e4cb7c2/https://www.loldrivers.io/drivers/6c84d133-c619-4deb-a91a-5cf05e4cb7c2/Fri, 20 Mar 2026 00:00:00 GMTAbyssWorker rootkit masquerading as a CrowdStrike Falcon sensor driver (CSAgent.sys). Signed with a revoked certificate from Shenzhen yundian Technology Co., Ltd. This is a fully malicious driver that blinds security products by stripping handles, terminating processes, and removing notification callbacks. Identified in ESET EDR killers research (March 2026) deployed alongside Medusa ransomware via the HEARTCRYPT packer.https://www.loldrivers.io/drivers/81211b5b-36a7-41d6-a6e3-8e43cf7d0405/https://www.loldrivers.io/drivers/81211b5b-36a7-41d6-a6e3-8e43cf7d0405/Fri, 20 Mar 2026 00:00:00 GMTHardware read/write driver signed by a revoked Certum certificate (Open Source Developer, Jun Liu). Provides arbitrary physical memory read/write and PCI bus data access. Identified in ESET EDR killers research (March 2026) with 174 execution parents indicating widespread abuse by threat actors to disable EDR products.https://www.loldrivers.io/drivers/ed27c0b8-6177-4132-a7af-5c15bcb386f3/https://www.loldrivers.io/drivers/ed27c0b8-6177-4132-a7af-5c15bcb386f3/Fri, 20 Mar 2026 00:00:00 GMTAMD USB-C Power Delivery Firmware Update Kernel Library driver with arbitrary physical memory read/write capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.https://www.loldrivers.io/drivers/d9a9fd72-e789-4bba-9b96-549b123e5c40/https://www.loldrivers.io/drivers/d9a9fd72-e789-4bba-9b96-549b123e5c40/Fri, 20 Mar 2026 00:00:00 GMTRising Antivirus rspot.sys driver with kernel-level process termination capabilities. Identified in ESET EDR killers research (March 2026) as actively abused by threat actors to disable EDR products.https://www.loldrivers.io/drivers/8d23f7e6-341a-431e-9dc1-bc797773d411/https://www.loldrivers.io/drivers/8d23f7e6-341a-431e-9dc1-bc797773d411/Fri, 20 Mar 2026 00:00:00 GMTHyperTech DNP CrackProof DRM kernel drivers (32-bit and 64-bit variants) from Shimano E-TUBE Project. Expose EPROCESS manipulation IOCTLs (0xAA013880, 0xAA013884, 0xAA013888) similar to capcom.sys exploitation technique. Device accessible at \\.\Htsysm4EFB. Zero detections (0/72 and 0/73) on VirusTotal. Signed by Microsoft WHCP via HyperTech DNP CrackProof (Japanese DRM vendor).https://www.loldrivers.io/drivers/0712c54c-69fd-41f2-950a-da678ac51246/https://www.loldrivers.io/drivers/0712c54c-69fd-41f2-950a-da678ac51246/Fri, 20 Mar 2026 00:00:00 GMTSafetica STProcessMonitor / ProcessMonitorDriver.sys exposes process-termination functionality through vulnerable IOCTL paths documented in public BYOVD research. The tracked samples include the 11.26.18.0 build and the legacy 11.11.4.0 build; public research notes that affected versions can be abused to terminate endpoint security processes from kernel context.https://www.loldrivers.io/drivers/4c009d0a-8dfa-49f7-b043-b9cef3b01101/https://www.loldrivers.io/drivers/4c009d0a-8dfa-49f7-b043-b9cef3b01101/Fri, 20 Mar 2026 00:00:00 GMTOCular THelper driver with arbitrary kernel memory read/write and process manipulation capabilities. Identified in ESET EDR killers research (March 2026) with 46 execution parents linked to AgentStp campaigns abusing the driver to disable EDR products.https://www.loldrivers.io/drivers/651d1cdc-3e13-405f-b8b3-65cc70cef5a8/https://www.loldrivers.io/drivers/651d1cdc-3e13-405f-b8b3-65cc70cef5a8/Fri, 20 Mar 2026 00:00:00 GMTTeramind Inc. kernel-mode filter drivers (tm_filter.sys and tmfsdrv2.sys) providing kernel-level input capture including keylogging and screen capture capabilities. Both signed by DigiCert under Teramind Inc. certificate. Execution parents point to teramind_agent MSI installer. Abused by threat actors for stealth monitoring operations. tmfsdrv2.sys has 1/73 detections on VirusTotal.https://www.loldrivers.io/drivers/b4f3a1c2-e8d7-4f92-a301-5c6d9e0b1a2f/https://www.loldrivers.io/drivers/b4f3a1c2-e8d7-4f92-a301-5c6d9e0b1a2f/Fri, 13 Feb 2026 00:00:00 GMTLoad TVicPort64.sys kernel driver. Once loaded, device \\.\TVicPortDevice0 is accessible from any integrity level (no DACL). Send IOCTL 0x80002008 to map arbitrary physical memory into user-mode VA space via ZwMapViewOfSection and perform token stealing for LPE to SYSTEM.https://www.loldrivers.io/drivers/708650ed-c497-48be-97bc-9edd48cf2a1a/https://www.loldrivers.io/drivers/708650ed-c497-48be-97bc-9edd48cf2a1a/Tue, 09 Dec 2025 00:00:00 GMTDriver can be used to load unsigned drivers. IOCTL code which takes a PID and terminates it (arbitrary process termination). Admin privileges required to install the driver, but if it's already installed, can be called by any user (non admin).https://www.loldrivers.io/drivers/ef848b1c-e197-4f98-aa19-4580f41a98b8/https://www.loldrivers.io/drivers/ef848b1c-e197-4f98-aa19-4580f41a98b8/Fri, 07 Nov 2025 00:00:00 GMTA vulnerable kernel driver that can be used to disable Code Integrityhttps://www.loldrivers.io/drivers/73bd234a-6c4f-4304-9e7d-5bc7a3f263e2/https://www.loldrivers.io/drivers/73bd234a-6c4f-4304-9e7d-5bc7a3f263e2/Mon, 27 Oct 2025 00:00:00 GMThlpdrv.sys is a malicious driver used to disable Windows Defender by modifying registry settings. This driver has been observed in Akira ransomware campaigns, where it is deployed to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Driver (BYOVD) exploitation chain. The malware modifies the DisableAntiSpyware registry key via regedit.exe execution.https://www.loldrivers.io/drivers/bb20edec-ecd4-4acd-9ad2-e4559748b336/https://www.loldrivers.io/drivers/bb20edec-ecd4-4acd-9ad2-e4559748b336/Thu, 09 Oct 2025 00:00:00 GMTBurntCigar (aka POORTRY) is a malicious kernel-mode rootkit driver used by multiple ransomware groups including Cuba, BlackCat, Medusa, LockBit, and RansomHub. Designed to disable and remove EDR solutions by terminating security processes and deleting critical security software files. VMProtect-packed driver signed with stolen Blueone Technology certificate. Detected by 32.9% of AV engines. Facilitates ransomware deployment by rendering systems defenseless.https://www.loldrivers.io/drivers/636d30fd-2b95-4dc2-a413-be0e43d1482c/https://www.loldrivers.io/drivers/636d30fd-2b95-4dc2-a413-be0e43d1482c/Thu, 09 Oct 2025 00:00:00 GMTMalicious rootkit masquerading as legitimate CrowdStrike Falcon Sensor driver (CSAgent.sys). Signed with stolen/expired Chinese certificate from 2015. Detected by 61.6% of AV engines as Rootkit.Win64.Agent and Trojan:Win64/AVTamper. Used to establish kernel-level persistence while evading detection by impersonating trusted security software.https://www.loldrivers.io/drivers/f8ed41ef-18f0-441c-99b8-def062214d0e/https://www.loldrivers.io/drivers/f8ed41ef-18f0-441c-99b8-def062214d0e/Thu, 18 Sep 2025 00:00:00 GMTDriver can be used to load unsigned drivershttps://www.loldrivers.io/drivers/9f88300d-e607-4e50-8626-fd799439e049/https://www.loldrivers.io/drivers/9f88300d-e607-4e50-8626-fd799439e049/Thu, 18 Sep 2025 00:00:00 GMTDriver can be used to load unsigned drivershttps://www.loldrivers.io/drivers/bd580aba-a804-4afc-adb3-b8ce342c78f6/https://www.loldrivers.io/drivers/bd580aba-a804-4afc-adb3-b8ce342c78f6/Thu, 18 Sep 2025 00:00:00 GMTDriver can be used to load unsigned drivershttps://www.loldrivers.io/drivers/7f80bb6e-bbf6-46dd-b77d-ecef24f1c2cd/https://www.loldrivers.io/drivers/7f80bb6e-bbf6-46dd-b77d-ecef24f1c2cd/Thu, 18 Sep 2025 00:00:00 GMTDriver can be used to load unsigned drivershttps://www.loldrivers.io/drivers/fb36ebc6-fdc5-42eb-929b-a07e00c5b9db/https://www.loldrivers.io/drivers/fb36ebc6-fdc5-42eb-929b-a07e00c5b9db/Thu, 18 Sep 2025 00:00:00 GMTDriver can be used to load unsigned drivershttps://www.loldrivers.io/drivers/c1143cd9-a709-4323-9678-2117285d1b47/https://www.loldrivers.io/drivers/c1143cd9-a709-4323-9678-2117285d1b47/Thu, 18 Sep 2025 00:00:00 GMTDriver used by ValleyRAT malware to terminate security processes via IOCTL 0x2248E0https://www.loldrivers.io/drivers/981210cb-8b84-4d37-b46e-b71059b8c438/https://www.loldrivers.io/drivers/981210cb-8b84-4d37-b46e-b71059b8c438/Thu, 28 Aug 2025 00:00:00 GMTVulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel modehttps://www.loldrivers.io/drivers/9cb4b2fa-67fb-4415-a064-7da7bc47e105/https://www.loldrivers.io/drivers/9cb4b2fa-67fb-4415-a064-7da7bc47e105/Thu, 28 Aug 2025 00:00:00 GMTVulnerable WatchDog Antimalware driver used by Silver Fox APT group to load unsigned drivers and execute malicious code in kernel modehttps://www.loldrivers.io/drivers/9c4e45c8-8f99-40b4-bb73-2e1cfa813034/https://www.loldrivers.io/drivers/9c4e45c8-8f99-40b4-bb73-2e1cfa813034/Fri, 08 Aug 2025 00:00:00 GMTAccording to Sophos X-Ops (Aug 06, 2025), a widely shared EDR-killer toolkit drops/loads a malicious kernel driver signed with compromised or revoked certificates to disable endpoint protections. Variants target many vendors, and are commonly HeartCrypt-packed and used by ransomware groups (e.g., RansomHub, INC). The payload uses hard-coded driver names (e.g., mraml.sys, noedt.sys) and kills security services/processes.https://www.loldrivers.io/drivers/8e673a36-4f16-4f4c-acf7-ca95bc586384/https://www.loldrivers.io/drivers/8e673a36-4f16-4f4c-acf7-ca95bc586384/Fri, 08 Aug 2025 00:00:00 GMTSophos X-Ops (Aug 06, 2025) documents a shared EDR-killer technique where a user-mode loader deploys a malicious kernel driver signed with compromised/revoked certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The driver terminates processes/services of multiple security vendors and is often delivered packed with HeartCrypt during ransomware intrusions (RansomHub, INC, others). Sample-specific driver names (e.g., mraml.sys, noedt.sys) are hard-coded in the payload.https://www.loldrivers.io/drivers/85f8ad5b-c5aa-468b-99f3-4b0aacfaa724/https://www.loldrivers.io/drivers/85f8ad5b-c5aa-468b-99f3-4b0aacfaa724/Fri, 08 Aug 2025 00:00:00 GMTPer Sophos X-Ops research (Aug 06, 2025), threat actors deploy an EDR-killer that loads a malicious kernel driver (often with a random five-letter name) signed with compromised or revoked code-signing certificates (e.g., Changsha Hengxiang Information Technology; Fuzhou Dingxin Trade). The tool targets many security products by killing their services and processes and is frequently distributed packed with HeartCrypt by ransomware groups (e.g., RansomHub, INC). Driver names are hard-coded per sample (e.g., mraml.sys, noedt.sys).https://www.loldrivers.io/drivers/6e0786f5-2168-40a8-a068-e261c4eb10e7/https://www.loldrivers.io/drivers/6e0786f5-2168-40a8-a068-e261c4eb10e7/Thu, 29 May 2025 00:00:00 GMTThrottleStop is developed by TechPowerUp and is designed to monitor for and correct CPU throttling issues. However, Kaspersky researchers from the Global Emergency Response Team (GERT) found out that it is being abused by attackers to terminate defense mechanisms.https://www.loldrivers.io/drivers/09c46890-5aa1-4122-962e-7ed94754e710/https://www.loldrivers.io/drivers/09c46890-5aa1-4122-962e-7ed94754e710/Wed, 28 May 2025 00:00:00 GMTA vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping physical memory via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.https://www.loldrivers.io/drivers/c95a796a-a8f6-4cfa-bc42-4936ecb59091/https://www.loldrivers.io/drivers/c95a796a-a8f6-4cfa-bc42-4936ecb59091/Wed, 26 Mar 2025 00:00:00 GMTABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.https://www.loldrivers.io/drivers/fd6c52b1-aeaa-4d89-8051-91acc68c3270/https://www.loldrivers.io/drivers/fd6c52b1-aeaa-4d89-8051-91acc68c3270/Wed, 26 Mar 2025 00:00:00 GMTABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.https://www.loldrivers.io/drivers/9974b134-7fee-4c7a-9b0d-38b3b2d7e957/https://www.loldrivers.io/drivers/9974b134-7fee-4c7a-9b0d-38b3b2d7e957/Wed, 26 Mar 2025 00:00:00 GMTABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.https://www.loldrivers.io/drivers/ca6455d1-b06e-496c-be33-f89c41b27540/https://www.loldrivers.io/drivers/ca6455d1-b06e-496c-be33-f89c41b27540/Wed, 26 Mar 2025 00:00:00 GMTABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.https://www.loldrivers.io/drivers/0144dbef-1da8-406c-8e35-7afee57dc471/https://www.loldrivers.io/drivers/0144dbef-1da8-406c-8e35-7afee57dc471/Wed, 26 Mar 2025 00:00:00 GMTABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.https://www.loldrivers.io/drivers/bd6490c2-20ea-441e-803c-bc3b957dae4c/https://www.loldrivers.io/drivers/bd6490c2-20ea-441e-803c-bc3b957dae4c/Wed, 26 Mar 2025 00:00:00 GMTABYSSWORKER is a malicious driver used in MEDUSA ransomware attacks to disable EDR systems. The driver masquerades as a legitimate CrowdStrike Falcon driver and provides extensive capabilities to terminate processes, remove security callbacks, manipulate files, and disable security tools. It uses stolen certificates from Chinese companies and requires a specific password for activation. The driver was observed being deployed alongside HEARTCRYPT-packed loaders and provides attackers with kernel-level capabilities to blind EDR products by removing notification callbacks, detaching mini-filter devices, and replacing driver major functions.https://www.loldrivers.io/drivers/87d5ec39-482e-4e78-a003-be4b662f85fc/https://www.loldrivers.io/drivers/87d5ec39-482e-4e78-a003-be4b662f85fc/Sat, 22 Mar 2025 00:00:00 GMTCheck Point ZoneAlarm driver (vsdatant.sys) abused in BYOVD attacks to gain kernel privileges and bypass protections such as Memory Integrity.https://www.loldrivers.io/drivers/e6378671-986d-42a1-8e7a-717117c83751/https://www.loldrivers.io/drivers/e6378671-986d-42a1-8e7a-717117c83751/Sun, 02 Mar 2025 00:00:00 GMTParagon Hard Disk Manager BioNTdrv.sys versions 10.1.x and older, 1.0.0.0, 1.1.0.0, 1.3.0.0, 1.4.0.0, and 1.5.1.0 contain five vulnerabilities that expose arbitrary kernel-memory mapping, write, and move operations, insecure kernel resource access, and a null-pointer dereference. Local attackers can use the affected driver to elevate to SYSTEM or cause a denial of service. CVE-2025-0289 has been observed in ransomware BYOVD attacks. Version 2.0.0 fixes the flaws.https://www.loldrivers.io/drivers/c0634ed7-840e-4a7e-8b34-33efe50405c2/https://www.loldrivers.io/drivers/c0634ed7-840e-4a7e-8b34-33efe50405c2/Fri, 31 Jan 2025 00:00:00 GMTA driver associated with Toshiba laptops power saving functionality allows arbitary one byte reading and writing mapped physical addresses. Blackpoint Cyber's SOC observed this driver being used as part of a custom EDRSandblast malware to blind EDR prior to Qilin ransomware deployment.https://www.loldrivers.io/drivers/3bf3fd5d-dee3-42da-b8be-6a0b8b7bc88c/https://www.loldrivers.io/drivers/3bf3fd5d-dee3-42da-b8be-6a0b8b7bc88c/Wed, 29 Jan 2025 00:00:00 GMTA vulnerable kernel driver that can be used to terminate arbitrary processeshttps://www.loldrivers.io/drivers/86b9c8d6-9c59-4fd4-befd-ab9a36a19e36/https://www.loldrivers.io/drivers/86b9c8d6-9c59-4fd4-befd-ab9a36a19e36/Mon, 13 Jan 2025 00:00:00 GMThttps://www.loldrivers.io/drivers/375e8de3-aae4-488d-8273-66744978b45f/https://www.loldrivers.io/drivers/375e8de3-aae4-488d-8273-66744978b45f/Fri, 10 Jan 2025 00:00:00 GMTThe StopZilla driver is a forgotten but still exploitable vulnerable driver that allows arbitrary kernel memory writes via unvalidated IOCTLs (0x80002063 and 0x8000206F). Attackers can leverage it to escalate privileges, disable LSASS PPL protection, and even modify PreviousMode in _KTHREAD to execute user-mode code as kernel-mode, effectively bypassing security checks. Despite its risks, it remains unblocked by Microsoft’s Driver Block List and many AV/EDR solutions. This driver highlights the persistent threat of forgotten vulnerable drivers still exploitable in modern Windows environments.https://www.loldrivers.io/drivers/d9e9fab2-6b64-4c14-b1ec-7af1923c0773/https://www.loldrivers.io/drivers/d9e9fab2-6b64-4c14-b1ec-7af1923c0773/Wed, 11 Sep 2024 00:00:00 GMTAccelLid.sys is an Elitegroup Computer Systems lid accelerometer kernel driver. Northwave Cyber Security reported a local denial-of-service vulnerability with a CVSSv3 score of 5.5. The driver exposes IOCTL paths for accelerometer commands, keyboard control, event registration, and ACPI method execution. Microsoft's vulnerable driver blocklist denies AccelLid.sys across all file versions for matching Elitegroup publisher and signing roots.https://www.loldrivers.io/drivers/48aeea9b-7812-4b25-9835-baaebe7dc551/https://www.loldrivers.io/drivers/48aeea9b-7812-4b25-9835-baaebe7dc551/Wed, 11 Sep 2024 00:00:00 GMTADLINK Resource Manager exposes physical-memory mapping through IOCTL 0x2234D4, allowing low-privilege callers to read kernel memory. The interface has also been weaponized by Blackout Reloaded to terminate protected antimalware processes through a driver path that reaches ZwTerminateProcess.https://www.loldrivers.io/drivers/ea0e7351-b65c-4c5a-9863-83b9d5efcec3/https://www.loldrivers.io/drivers/ea0e7351-b65c-4c5a-9863-83b9d5efcec3/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/5076e737-6744-4266-bef7-bceda65050d6/https://www.loldrivers.io/drivers/5076e737-6744-4266-bef7-bceda65050d6/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/c44e6197-efab-49d2-8a5f-04ae4a0f0ea0/https://www.loldrivers.io/drivers/c44e6197-efab-49d2-8a5f-04ae4a0f0ea0/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/8a1a4a5d-3e41-4539-80cd-0cb751f7fab3/https://www.loldrivers.io/drivers/8a1a4a5d-3e41-4539-80cd-0cb751f7fab3/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/0f64bf7a-2ef2-45ea-af7d-4e7c87d98777/https://www.loldrivers.io/drivers/0f64bf7a-2ef2-45ea-af7d-4e7c87d98777/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privelege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/c8619f49-8e23-489b-9878-53d27533da15/https://www.loldrivers.io/drivers/c8619f49-8e23-489b-9878-53d27533da15/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a local dos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/3a9ea9a6-e5e3-439a-b892-1f78dd990099/https://www.loldrivers.io/drivers/3a9ea9a6-e5e3-439a-b892-1f78dd990099/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privilege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/07c57c69-c8d7-40cf-8bcc-612671427044/https://www.loldrivers.io/drivers/07c57c69-c8d7-40cf-8bcc-612671427044/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 8.8, indicating a privelege escalation impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/424a387e-735e-49d1-99de-f067dcf1c3e9/https://www.loldrivers.io/drivers/424a387e-735e-49d1-99de-f067dcf1c3e9/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security identified TSDRVX64 as a local privilege-escalation vulnerability with a CVSSv3 score of 8.8. Successful exploitation provides kernel-level impact and may enable an attacker to disable security controls or tamper with the operating system.https://www.loldrivers.io/drivers/4cb95b41-43b4-4806-b536-ae5fd8c76b0e/https://www.loldrivers.io/drivers/4cb95b41-43b4-4806-b536-ae5fd8c76b0e/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 5.5, indicating a information disclosure / local dos impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/30e8d598-2c60-49e4-953b-a6f620da1371/https://www.loldrivers.io/drivers/30e8d598-2c60-49e4-953b-a6f620da1371/Wed, 11 Sep 2024 00:00:00 GMTNorthwave Cyber Security contributed this driver based on in-house research. The driver has a CVSSv3 score of 6.1, indicating a antivirus killer impact. This vulnerability could potentially be exploited for privilege escalation or other malicious activities.https://www.loldrivers.io/drivers/bb1f80f3-d2fd-463e-9403-57c919bd976b/https://www.loldrivers.io/drivers/bb1f80f3-d2fd-463e-9403-57c919bd976b/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/7a9d34e4-c660-4388-ab61-4fd6f6bf1ad4/https://www.loldrivers.io/drivers/7a9d34e4-c660-4388-ab61-4fd6f6bf1ad4/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/00561455-9da1-4f0c-8564-e4c99b716a74/https://www.loldrivers.io/drivers/00561455-9da1-4f0c-8564-e4c99b716a74/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/2ba1bccf-d8d7-464a-9ae1-41371c55e5e8/https://www.loldrivers.io/drivers/2ba1bccf-d8d7-464a-9ae1-41371c55e5e8/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/82087b26-b649-4ad1-a353-3a225c757ff7/https://www.loldrivers.io/drivers/82087b26-b649-4ad1-a353-3a225c757ff7/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/8081b0d0-e18e-474a-bdfa-8ff1956d90cb/https://www.loldrivers.io/drivers/8081b0d0-e18e-474a-bdfa-8ff1956d90cb/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/cea8bd08-a3c5-4ae1-a568-387b909ada67/https://www.loldrivers.io/drivers/cea8bd08-a3c5-4ae1-a568-387b909ada67/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/a0f0d0db-15a2-48e4-af39-50967ee8b541/https://www.loldrivers.io/drivers/a0f0d0db-15a2-48e4-af39-50967ee8b541/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/af153e7c-13fa-4a40-a095-00726ad6d783/https://www.loldrivers.io/drivers/af153e7c-13fa-4a40-a095-00726ad6d783/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/d7773616-9860-4768-b6a2-d74f32c23b4e/https://www.loldrivers.io/drivers/d7773616-9860-4768-b6a2-d74f32c23b4e/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/9e0a1bae-6509-41fd-a5bf-dfe6cf388682/https://www.loldrivers.io/drivers/9e0a1bae-6509-41fd-a5bf-dfe6cf388682/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/f5c1a46f-21e6-4b06-b212-2dc55b699497/https://www.loldrivers.io/drivers/f5c1a46f-21e6-4b06-b212-2dc55b699497/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/495f0f36-c5e0-467d-8115-b5bdbe7ff686/https://www.loldrivers.io/drivers/495f0f36-c5e0-467d-8115-b5bdbe7ff686/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/e7fd8ffc-ab37-4a7b-8dc9-fc7432fbacae/https://www.loldrivers.io/drivers/e7fd8ffc-ab37-4a7b-8dc9-fc7432fbacae/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/b660d253-2b60-46c5-b95a-c354aa5eb154/https://www.loldrivers.io/drivers/b660d253-2b60-46c5-b95a-c354aa5eb154/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/85335187-dae0-4f06-acea-209efaf74973/https://www.loldrivers.io/drivers/85335187-dae0-4f06-acea-209efaf74973/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/647f72e7-f378-4908-946c-5e45fab448e8/https://www.loldrivers.io/drivers/647f72e7-f378-4908-946c-5e45fab448e8/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/0215d6d6-e0c4-4a11-bd3a-40511f89d736/https://www.loldrivers.io/drivers/0215d6d6-e0c4-4a11-bd3a-40511f89d736/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/04eefdf4-448d-45bb-87fc-93f263fc77f4/https://www.loldrivers.io/drivers/04eefdf4-448d-45bb-87fc-93f263fc77f4/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/5fb86651-c152-404a-9a2f-0f54b0d2bb55/https://www.loldrivers.io/drivers/5fb86651-c152-404a-9a2f-0f54b0d2bb55/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/af8ef3c0-8686-4112-992b-86587a4a9060/https://www.loldrivers.io/drivers/af8ef3c0-8686-4112-992b-86587a4a9060/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/e1c29414-5b5b-44f4-84cc-e6f55d9a23c6/https://www.loldrivers.io/drivers/e1c29414-5b5b-44f4-84cc-e6f55d9a23c6/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/750a8aa9-a87c-4142-b96b-18ea139ada14/https://www.loldrivers.io/drivers/750a8aa9-a87c-4142-b96b-18ea139ada14/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/4c4e7664-af86-4483-858a-f59346f3d304/https://www.loldrivers.io/drivers/4c4e7664-af86-4483-858a-f59346f3d304/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/1106fe7a-b78b-4edf-85c0-6208979f380b/https://www.loldrivers.io/drivers/1106fe7a-b78b-4edf-85c0-6208979f380b/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/f694c0e1-b75d-4c41-acbd-a87b72d8abe4/https://www.loldrivers.io/drivers/f694c0e1-b75d-4c41-acbd-a87b72d8abe4/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/09d2e61d-e041-4ec8-ab7b-385848456a36/https://www.loldrivers.io/drivers/09d2e61d-e041-4ec8-ab7b-385848456a36/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/51a44484-8bcc-4150-8b94-4a755cff0af8/https://www.loldrivers.io/drivers/51a44484-8bcc-4150-8b94-4a755cff0af8/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/dbfcce10-76a3-44a4-a9b8-d7126152a235/https://www.loldrivers.io/drivers/dbfcce10-76a3-44a4-a9b8-d7126152a235/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/f6c08b8a-1d25-4bf1-9d4f-5368c1f6cfe7/https://www.loldrivers.io/drivers/f6c08b8a-1d25-4bf1-9d4f-5368c1f6cfe7/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/8697785a-d088-42a7-ac25-b5c8a3b22664/https://www.loldrivers.io/drivers/8697785a-d088-42a7-ac25-b5c8a3b22664/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/576bb95a-f15e-4a0d-bcee-08791e1504e2/https://www.loldrivers.io/drivers/576bb95a-f15e-4a0d-bcee-08791e1504e2/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/11a73c42-26aa-446b-8560-43eecb265091/https://www.loldrivers.io/drivers/11a73c42-26aa-446b-8560-43eecb265091/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/14e51012-5429-483e-9423-49778c3bd1c2/https://www.loldrivers.io/drivers/14e51012-5429-483e-9423-49778c3bd1c2/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/da066835-f37c-40bf-86bb-d77ad45c7f30/https://www.loldrivers.io/drivers/da066835-f37c-40bf-86bb-d77ad45c7f30/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/17a1ad58-ecf3-4dea-b1ca-336880d15256/https://www.loldrivers.io/drivers/17a1ad58-ecf3-4dea-b1ca-336880d15256/Tue, 10 Sep 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/32155681-33e8-4d0d-b9f6-c822851e7321/https://www.loldrivers.io/drivers/32155681-33e8-4d0d-b9f6-c822851e7321/Tue, 10 Sep 2024 00:00:00 GMTThe Realtek SD card reader driver, RtsPer.sys, has been found to contain multiple critical vulnerabilities (CVE-2022-25476, CVE-2022-25477, CVE-2022-25478, CVE-2022-25479, CVE-2022-25480, CVE-2024-40431, CVE-2024-40432) that allow non-privileged users to leak kernel memory, write to arbitrary kernel memory, and access physical memory via DMA. These flaws affect various SD card reader models (including RTS5227, RTS5228, RTS522A, RTS5249, RTS524A, RTS5250, RTS525A, RTS5287, RTS5260, RTS5261, RTS5264) used by major OEMs such as Dell, Lenovo, HP, and MSI. The vulnerabilities enable kernel memory leaks, arbitrary kernel memory writes, PCI configuration space manipulation, and DMA controller access from user mode. Due to the driver's widespread use, the impact is significant, potentially allowing privilege escalation and system compromise. Realtek has addressed these issues in driver version 10.0.26100.21374 or higher, released in July or August.https://www.loldrivers.io/drivers/71d930a7-3465-4d27-90d4-2a1a08bebb92/https://www.loldrivers.io/drivers/71d930a7-3465-4d27-90d4-2a1a08bebb92/Tue, 10 Sep 2024 00:00:00 GMTThe Realtek SD card reader driver, RtsUer.sys, versions below or equal to 10.0.22000.31273 contain multiple vulnerabilities that pose significant security risks. These flaws allow non-privileged users to write to kernel memory and access the DMA controller from unprivileged accounts, potentially enabling privilege escalation and system compromise. The most severe issues include the ability to write to kernel memory and access the DMA controller, which could lead to unauthorized system modifications. These vulnerabilities affect various Realtek SD card reader models used by major OEM laptop manufacturers. Due to the widespread use of this driver, the impact is considerable, potentially affecting a large number of systems across different brands. Users with laptops equipped with Realtek SD card readers should ensure their drivers are updated to a version higher than 10.0.22000.31273 to mitigate these security risks.https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/https://www.loldrivers.io/drivers/45a31a17-f78d-48ec-beba-74f6bfc5f96e/Tue, 10 Sep 2024 00:00:00 GMTWinDivert is a user-mode packet capture and network packet manipulation utility designed for Windows. It provides a powerful and flexible framework for intercepting, modifying, injecting, and dropping network packets at the network stack level. It operates as a lightweight, high-performance driver that interfaces directly with the network stack, allowing for detailed packet inspection and manipulation in real time.https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/https://www.loldrivers.io/drivers/c2e98102-2055-48f0-9449-3e7a7f2c0ffe/Wed, 28 Aug 2024 00:00:00 GMTSophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.https://www.loldrivers.io/drivers/394f49b2-2d78-4d0d-b374-1399695455f3/https://www.loldrivers.io/drivers/394f49b2-2d78-4d0d-b374-1399695455f3/Wed, 21 Aug 2024 00:00:00 GMTWindows Ancillary Function Driver (Afd.sys) for WinSock is vulnerable to an Elevation of Privilege Vulnerability.https://www.loldrivers.io/drivers/1c92e1bf-103b-4545-b242-e5a9858ec9c8/https://www.loldrivers.io/drivers/1c92e1bf-103b-4545-b242-e5a9858ec9c8/Wed, 21 Aug 2024 00:00:00 GMTImproper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code in the csc.sys driverhttps://www.loldrivers.io/drivers/bd9f084e-b235-4978-bf2a-5f1dc02937df/https://www.loldrivers.io/drivers/bd9f084e-b235-4978-bf2a-5f1dc02937df/Thu, 15 Aug 2024 00:00:00 GMThttps://www.loldrivers.io/drivers/de62baae-872d-4e9a-b6d9-b0ac99854c66/https://www.loldrivers.io/drivers/de62baae-872d-4e9a-b6d9-b0ac99854c66/Thu, 20 Jun 2024 00:00:00 GMTChaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes and ability to restrict access to files except for whitelisted process work seamlessly on the latest Windows versions.https://www.loldrivers.io/drivers/af98f6e6-f19e-4705-a7b9-e7ee7377447b/https://www.loldrivers.io/drivers/af98f6e6-f19e-4705-a7b9-e7ee7377447b/Thu, 20 Jun 2024 00:00:00 GMTTwister Antivirus, fildds.sys, DoS2 CVE-2023-1444 From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.https://www.loldrivers.io/drivers/ba91bce3-2cf9-4c44-bbd8-1170a44d23db/https://www.loldrivers.io/drivers/ba91bce3-2cf9-4c44-bbd8-1170a44d23db/Thu, 20 Jun 2024 00:00:00 GMTTwister Antivirus, fildds.sys, DoS2 CVE-2023-1444 From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.https://www.loldrivers.io/drivers/9d4358c3-5d6e-48a0-971e-e2ad7724c106/https://www.loldrivers.io/drivers/9d4358c3-5d6e-48a0-971e-e2ad7724c106/Thu, 20 Jun 2024 00:00:00 GMTTwister Antivirus, fildds.sys, DoS2 CVE-2023-1444 From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.https://www.loldrivers.io/drivers/0d6f1b0f-b94d-4254-b3bb-49de61246260/https://www.loldrivers.io/drivers/0d6f1b0f-b94d-4254-b3bb-49de61246260/Thu, 20 Jun 2024 00:00:00 GMTUtilized in RealBlindingEDR.https://www.loldrivers.io/drivers/baa168cd-eba2-42e4-95e9-47cb4b2f9094/https://www.loldrivers.io/drivers/baa168cd-eba2-42e4-95e9-47cb4b2f9094/Thu, 20 Jun 2024 00:00:00 GMTUtilized in RealBlindingEDR.https://www.loldrivers.io/drivers/ff77b58d-e143-4f61-92de-c0d9bc0af7d5/https://www.loldrivers.io/drivers/ff77b58d-e143-4f61-92de-c0d9bc0af7d5/Thu, 22 Feb 2024 00:00:00 GMTAllows privilege escalation from regular user to System or PPLhttps://www.loldrivers.io/drivers/77157886-00f9-4f6e-b217-d896813b630f/https://www.loldrivers.io/drivers/77157886-00f9-4f6e-b217-d896813b630f/Wed, 24 Jan 2024 00:00:00 GMThttps://www.loldrivers.io/drivers/ee6fa2de-d388-416c-862d-24385c152fad/https://www.loldrivers.io/drivers/ee6fa2de-d388-416c-862d-24385c152fad/Sat, 02 Dec 2023 00:00:00 GMTIdentified on the MSFT Driver Block list, non-admin can write MSR.https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/https://www.loldrivers.io/drivers/7cee2ce8-7881-4a9a-bb18-61587c95f4a2/Thu, 30 Nov 2023 00:00:00 GMTbundled with chinese application "DrvCeo" is a set of rootkits. The malicious functionality. prevents registry value writing where the registry key or value includes "dcprotect" or "drvceo". Prevents file deletion if pathname contains "driverdownload", "program files\sysceo", "program files (x86)\sysceo"https://www.loldrivers.io/drivers/e0e93453-1007-4799-ad02-9b461b7e0398/https://www.loldrivers.io/drivers/e0e93453-1007-4799-ad02-9b461b7e0398/Fri, 10 Nov 2023 00:00:00 GMTThis is a C# AV/EDR Killer using Rogue Anti-Malware Driver 3.3. This driver is not present in the loldrivers or Windows blocklist at the time of this writing. The only reason I'm making this public is because the company has already published a fix in version 3.4, and Microsoft will likely block this driver soon. This driver can be used in Windows 23H2 with HVCI enabled, loldrivers blocklist, or WDAC enabled. HVCI is designed to ensure the integrity of code executed in the kernel, but it cannot protect against all possible vulnerabilities or actions that can be performed through drivers or system interfaces.https://www.loldrivers.io/drivers/a3c52cbe-90ca-432c-9520-761b60e7d9cb/https://www.loldrivers.io/drivers/a3c52cbe-90ca-432c-9520-761b60e7d9cb/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/fb783760-cb3f-4cf4-b4ac-8edb756b9821/https://www.loldrivers.io/drivers/fb783760-cb3f-4cf4-b4ac-8edb756b9821/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/4f0a65a7-9a01-40cb-8d95-0844515103e6/https://www.loldrivers.io/drivers/4f0a65a7-9a01-40cb-8d95-0844515103e6/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/fda3ff67-12dc-488c-a4c2-603f5bf420bd/https://www.loldrivers.io/drivers/fda3ff67-12dc-488c-a4c2-603f5bf420bd/Thu, 02 Nov 2023 00:00:00 GMTSangoma cg6kwin2k versions before 2.1.7.0 expose IOCTLs without sufficient access control. A low-privilege user can perform I/O against arbitrary hardware ports or physical addresses, enabling firmware erasure or modification.https://www.loldrivers.io/drivers/9bf033e4-7295-4b63-8772-638b76851741/https://www.loldrivers.io/drivers/9bf033e4-7295-4b63-8772-638b76851741/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/a08ee79f-801d-4b98-996f-55f6a72ac5f7/https://www.loldrivers.io/drivers/a08ee79f-801d-4b98-996f-55f6a72ac5f7/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/fa612342-5ae0-4e69-ad9c-14d574d9fb1e/https://www.loldrivers.io/drivers/fa612342-5ae0-4e69-ad9c-14d574d9fb1e/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/0f749d4e-145e-4b8e-bea6-47003d228043/https://www.loldrivers.io/drivers/0f749d4e-145e-4b8e-bea6-47003d228043/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/f16f82de-1ad0-47d8-a869-2c10ed25d9f1/https://www.loldrivers.io/drivers/f16f82de-1ad0-47d8-a869-2c10ed25d9f1/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/9543c507-9b10-4de8-89b9-42a4f24c99ec/https://www.loldrivers.io/drivers/9543c507-9b10-4de8-89b9-42a4f24c99ec/Thu, 02 Nov 2023 00:00:00 GMTFINTEK FPCIE2COM exposes FILE_ANY_ACCESS IOCTLs through \DosDevices\FPCIE2COM that map caller-selected physical addresses for byte reads and writes. It also permits raw PCI configuration access through I/O ports 0xCF8 and 0xCFC, creating privileged hardware-control primitives suitable for kernel or firmware tampering.https://www.loldrivers.io/drivers/e769d1f6-8a38-426f-b5e7-447241204ee1/https://www.loldrivers.io/drivers/e769d1f6-8a38-426f-b5e7-447241204ee1/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/b0dedc3f-6e4b-497a-aade-390cbf4beebb/https://www.loldrivers.io/drivers/b0dedc3f-6e4b-497a-aade-390cbf4beebb/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/f92f4c60-b39c-4726-ba74-dcab7f653ae2/https://www.loldrivers.io/drivers/f92f4c60-b39c-4726-ba74-dcab7f653ae2/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/c08c03ff-a7b7-4282-a9fc-265ae88dc244/https://www.loldrivers.io/drivers/c08c03ff-a7b7-4282-a9fc-265ae88dc244/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/3aa6e630-59be-4a15-a30c-aaed4c1edaf0/https://www.loldrivers.io/drivers/3aa6e630-59be-4a15-a30c-aaed4c1edaf0/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/b8339454-0e84-4a5b-92d0-6a626ced6677/https://www.loldrivers.io/drivers/b8339454-0e84-4a5b-92d0-6a626ced6677/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/837ad058-65f4-4b75-8f21-b842e48db8a5/https://www.loldrivers.io/drivers/837ad058-65f4-4b75-8f21-b842e48db8a5/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/3d7da79b-fe34-45cd-a0c9-d4432d40611c/https://www.loldrivers.io/drivers/3d7da79b-fe34-45cd-a0c9-d4432d40611c/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/fded7e63-0470-40fe-97ed-aa83fd027bad/https://www.loldrivers.io/drivers/fded7e63-0470-40fe-97ed-aa83fd027bad/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/2b918b1a-badb-4a85-9214-961607b21219/https://www.loldrivers.io/drivers/2b918b1a-badb-4a85-9214-961607b21219/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/7bb4d807-9a66-48ff-9fb7-82780f3b015e/https://www.loldrivers.io/drivers/7bb4d807-9a66-48ff-9fb7-82780f3b015e/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/36227ce7-2bf6-4963-bfae-c399000a1079/https://www.loldrivers.io/drivers/36227ce7-2bf6-4963-bfae-c399000a1079/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/8ecc8439-0554-40d0-9130-c02941deadbe/https://www.loldrivers.io/drivers/8ecc8439-0554-40d0-9130-c02941deadbe/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/cf805b21-4611-4983-a8b6-271373a45057/https://www.loldrivers.io/drivers/cf805b21-4611-4983-a8b6-271373a45057/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/942f58d2-1300-4957-98a0-5f8d601bf55b/https://www.loldrivers.io/drivers/942f58d2-1300-4957-98a0-5f8d601bf55b/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/2a7a59c1-35b8-42b6-a560-2fbf4247a584/https://www.loldrivers.io/drivers/2a7a59c1-35b8-42b6-a560-2fbf4247a584/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/f33c2e80-7b01-416b-821a-ed06db4b6511/https://www.loldrivers.io/drivers/f33c2e80-7b01-416b-821a-ed06db4b6511/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/dc3fdbd3-601a-4d2a-bf34-d2e84c6ff1d3/https://www.loldrivers.io/drivers/dc3fdbd3-601a-4d2a-bf34-d2e84c6ff1d3/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/62f76f62-ef82-49ea-a26f-36e5727e8d83/https://www.loldrivers.io/drivers/62f76f62-ef82-49ea-a26f-36e5727e8d83/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/c4eab0c0-caf2-42b9-84f1-b4690d3db0d4/https://www.loldrivers.io/drivers/c4eab0c0-caf2-42b9-84f1-b4690d3db0d4/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/4f47c65e-2e73-4855-813a-5a823ae845a8/https://www.loldrivers.io/drivers/4f47c65e-2e73-4855-813a-5a823ae845a8/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/933f5671-e995-4976-8392-52d34dcd4e05/https://www.loldrivers.io/drivers/933f5671-e995-4976-8392-52d34dcd4e05/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/5901421f-7929-487d-87bd-632f29290352/https://www.loldrivers.io/drivers/5901421f-7929-487d-87bd-632f29290352/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/a4795ab6-d908-44cf-9ebf-a47db367d385/https://www.loldrivers.io/drivers/a4795ab6-d908-44cf-9ebf-a47db367d385/Thu, 02 Nov 2023 00:00:00 GMTThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.https://www.loldrivers.io/drivers/257d425f-f660-466c-8bee-c24cccf06daa/https://www.loldrivers.io/drivers/257d425f-f660-466c-8bee-c24cccf06daa/Thu, 12 Oct 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/6736cbe7-33ea-4488-b464-231c0b8d1049/https://www.loldrivers.io/drivers/6736cbe7-33ea-4488-b464-231c0b8d1049/Thu, 12 Oct 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/97ed6c7b-be4c-4f60-9157-c788a555ca9f/https://www.loldrivers.io/drivers/97ed6c7b-be4c-4f60-9157-c788a555ca9f/Thu, 12 Oct 2023 00:00:00 GMTCVE-2021-33834https://www.loldrivers.io/drivers/a8f2da2a-369c-4b4d-9a00-d7a892b9f7c3/https://www.loldrivers.io/drivers/a8f2da2a-369c-4b4d-9a00-d7a892b9f7c3/Tue, 12 Sep 2023 00:00:00 GMTA vulnerability was found in Watchdog Anti-Virus 1.4.214.0. It has been rated as critical. Affected by this issue is the function 0x80002008 in the library wsdk-driver.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223298 is the identifier assigned to this vulnerability.https://www.loldrivers.io/drivers/aaf8ce1a-e11b-4929-96e0-5ec0666cef2c/https://www.loldrivers.io/drivers/aaf8ce1a-e11b-4929-96e0-5ec0666cef2c/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/b32d8d7d-0dc2-4d09-a306-8efc4caf1839/https://www.loldrivers.io/drivers/b32d8d7d-0dc2-4d09-a306-8efc4caf1839/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/2d6c1da6-17e2-4385-ad93-1430f83bde83/https://www.loldrivers.io/drivers/2d6c1da6-17e2-4385-ad93-1430f83bde83/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/75b9b0c5-dd3e-4cf3-a693-c80f2feabb6a/https://www.loldrivers.io/drivers/75b9b0c5-dd3e-4cf3-a693-c80f2feabb6a/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/ddca6daf-4932-4e82-ad3c-d92d47632ea4/https://www.loldrivers.io/drivers/ddca6daf-4932-4e82-ad3c-d92d47632ea4/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/2866bd72-a4b1-4764-a838-9ed0790c2631/https://www.loldrivers.io/drivers/2866bd72-a4b1-4764-a838-9ed0790c2631/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/ef6b5fe8-6c4b-4b32-8adc-c1d8a83e8558/https://www.loldrivers.io/drivers/ef6b5fe8-6c4b-4b32-8adc-c1d8a83e8558/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/ac62e709-4aa5-41f4-87b1-b811283d70d1/https://www.loldrivers.io/drivers/ac62e709-4aa5-41f4-87b1-b811283d70d1/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/a9ab4412-d484-459b-be97-5975f5ab8094/https://www.loldrivers.io/drivers/a9ab4412-d484-459b-be97-5975f5ab8094/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/ddefecdd-9410-46d9-8957-e23aac1aba0c/https://www.loldrivers.io/drivers/ddefecdd-9410-46d9-8957-e23aac1aba0c/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/c00f818c-1c90-4b47-bc29-fb949f6efb65/https://www.loldrivers.io/drivers/c00f818c-1c90-4b47-bc29-fb949f6efb65/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/4f2edf45-b135-404f-bedc-9583f0bae574/https://www.loldrivers.io/drivers/4f2edf45-b135-404f-bedc-9583f0bae574/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/8c2df58f-1e02-4911-ad40-3fa4ed1f4333/https://www.loldrivers.io/drivers/8c2df58f-1e02-4911-ad40-3fa4ed1f4333/Mon, 31 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/c7f76931-e24c-4d94-9e1f-5a083da581b4/https://www.loldrivers.io/drivers/c7f76931-e24c-4d94-9e1f-5a083da581b4/Tue, 25 Jul 2023 00:00:00 GMTThe criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificatehttps://www.loldrivers.io/drivers/dbb58de1-a1e5-4c7f-8fe0-4033502b1c63/https://www.loldrivers.io/drivers/dbb58de1-a1e5-4c7f-8fe0-4033502b1c63/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f/https://www.loldrivers.io/drivers/02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/213676bb-ffb9-4d0d-a442-8cefee63acc1/https://www.loldrivers.io/drivers/213676bb-ffb9-4d0d-a442-8cefee63acc1/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/a02e1801-f6fb-41c3-a782-05fdbed44a3c/https://www.loldrivers.io/drivers/a02e1801-f6fb-41c3-a782-05fdbed44a3c/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/b9b835bd-b720-424b-9160-2442bc4d6e58/https://www.loldrivers.io/drivers/b9b835bd-b720-424b-9160-2442bc4d6e58/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/9c4e2e75-a8be-4d2f-b016-e2a98281c8ec/https://www.loldrivers.io/drivers/9c4e2e75-a8be-4d2f-b016-e2a98281c8ec/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/cacf18a5-6d7d-4a63-92d4-bda386a3da18/https://www.loldrivers.io/drivers/cacf18a5-6d7d-4a63-92d4-bda386a3da18/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/45c42e32-6261-43c1-bdbd-cab58da729d8/https://www.loldrivers.io/drivers/45c42e32-6261-43c1-bdbd-cab58da729d8/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822/https://www.loldrivers.io/drivers/a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/7a0842ca-1a64-4ad1-9d66-25eb983d1742/https://www.loldrivers.io/drivers/7a0842ca-1a64-4ad1-9d66-25eb983d1742/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/a254e684-f6eb-40c4-a50a-7b76feb6cc02/https://www.loldrivers.io/drivers/a254e684-f6eb-40c4-a50a-7b76feb6cc02/Sat, 22 Jul 2023 00:00:00 GMTPassMark DirectIo64.sys builds through b1008 expose permissively accessible IOCTLs for physical memory, MSRs, PCI configuration space, x86 I/O ports, and kernel or physical-memory dumps. These primitives can support local SYSTEM elevation, kernel tampering, credential exposure, or denial of service. PassMark hardened the driver in b1012.https://www.loldrivers.io/drivers/9ca73d04-3349-4c16-9384-94c43335a031/https://www.loldrivers.io/drivers/9ca73d04-3349-4c16-9384-94c43335a031/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/1ab1ec8c-1231-4ba4-8804-4a2cda103bb8/https://www.loldrivers.io/drivers/1ab1ec8c-1231-4ba4-8804-4a2cda103bb8/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/https://www.loldrivers.io/drivers/2225128d-a23f-434a-aaee-69a88ea64fbd/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/080a834f-3e19-4cae-b940-a4ecf901db28/https://www.loldrivers.io/drivers/080a834f-3e19-4cae-b940-a4ecf901db28/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/https://www.loldrivers.io/drivers/97fa88f6-3819-4d56-a82c-52a492a9e2b5/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/https://www.loldrivers.io/drivers/e368efc7-cf69-47ae-8204-f69dac000b22/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/4c815256-2534-4476-b15d-7cbf24c80098/https://www.loldrivers.io/drivers/4c815256-2534-4476-b15d-7cbf24c80098/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/51808fa6-89a4-4f4d-aabc-0a7b0e99e34d/https://www.loldrivers.io/drivers/51808fa6-89a4-4f4d-aabc-0a7b0e99e34d/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/5961e133-ccc3-4530-8f4f-5d975c41028d/https://www.loldrivers.io/drivers/5961e133-ccc3-4530-8f4f-5d975c41028d/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/cf94939a-703f-46a4-917b-d6af7e0685ef/https://www.loldrivers.io/drivers/cf94939a-703f-46a4-917b-d6af7e0685ef/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/https://www.loldrivers.io/drivers/7abc873d-9c28-44c2-8f60-701a8e26af29/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/75a66604-f024-4f11-8ba7-fdd64a0df3bf/https://www.loldrivers.io/drivers/75a66604-f024-4f11-8ba7-fdd64a0df3bf/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/181b89e5-4bdd-4e95-b1bc-a294a4adfb29/https://www.loldrivers.io/drivers/181b89e5-4bdd-4e95-b1bc-a294a4adfb29/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/ebdde780-e142-44e7-a998-504c516f4695/https://www.loldrivers.io/drivers/ebdde780-e142-44e7-a998-504c516f4695/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/https://www.loldrivers.io/drivers/14556074-b235-4378-b356-f58721629d72/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/b074dcb5-b278-4434-bdd9-14a055d724f3/https://www.loldrivers.io/drivers/b074dcb5-b278-4434-bdd9-14a055d724f3/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/58509acb-50b4-41a0-9de3-76c571a459e3/https://www.loldrivers.io/drivers/58509acb-50b4-41a0-9de3-76c571a459e3/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/https://www.loldrivers.io/drivers/9454a752-233e-4ba2-b585-8da242bf8f31/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/https://www.loldrivers.io/drivers/5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/35a9afeb-18f1-4c02-a3aa-830e300138ae/https://www.loldrivers.io/drivers/35a9afeb-18f1-4c02-a3aa-830e300138ae/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/0f8e317e-ad2b-4b02-9f96-603bb8d28604/https://www.loldrivers.io/drivers/0f8e317e-ad2b-4b02-9f96-603bb8d28604/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/2a6a38ca-f2e6-456e-9ccf-db59d8c80c9e/https://www.loldrivers.io/drivers/2a6a38ca-f2e6-456e-9ccf-db59d8c80c9e/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/c33648d7-6473-4e2b-92f6-93f195bc183f/https://www.loldrivers.io/drivers/c33648d7-6473-4e2b-92f6-93f195bc183f/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/73290fcb-a0d7-481e-81a5-65a9859b50f5/https://www.loldrivers.io/drivers/73290fcb-a0d7-481e-81a5-65a9859b50f5/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/96c8fe71-3acc-41bc-9402-ebd69a961d74/https://www.loldrivers.io/drivers/96c8fe71-3acc-41bc-9402-ebd69a961d74/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/1055625b-3480-48b3-9556-8628a745d8f0/https://www.loldrivers.io/drivers/1055625b-3480-48b3-9556-8628a745d8f0/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/0e3b0052-18c7-4c8b-a064-a1332df07af2/https://www.loldrivers.io/drivers/0e3b0052-18c7-4c8b-a064-a1332df07af2/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/b9e01a11-6395-4837-a202-0c777d717a43/https://www.loldrivers.io/drivers/b9e01a11-6395-4837-a202-0c777d717a43/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/998ed67c-9c20-46ef-a6ba-abc606b540b9/https://www.loldrivers.io/drivers/998ed67c-9c20-46ef-a6ba-abc606b540b9/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/https://www.loldrivers.io/drivers/6c0c60f0-895d-428a-a8ae-e10390bceb12/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/https://www.loldrivers.io/drivers/5a03dc5a-115d-4d6f-b5b5-685f4c014a69/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/724d7989-dfce-4bb2-9beb-dee15df5b790/https://www.loldrivers.io/drivers/724d7989-dfce-4bb2-9beb-dee15df5b790/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/56b320b3-5b12-4ec6-81e2-5a16c56c7478/https://www.loldrivers.io/drivers/56b320b3-5b12-4ec6-81e2-5a16c56c7478/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/6356d7d9-3b82-4731-9d5f-cc9bc37558fc/https://www.loldrivers.io/drivers/6356d7d9-3b82-4731-9d5f-cc9bc37558fc/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/500e07cb-77c6-4e83-ae3f-73f70f1c10b5/https://www.loldrivers.io/drivers/500e07cb-77c6-4e83-ae3f-73f70f1c10b5/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/705facba-b595-41dd-86a6-93aefe6a6234/https://www.loldrivers.io/drivers/705facba-b595-41dd-86a6-93aefe6a6234/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/https://www.loldrivers.io/drivers/1aeb1205-8b02-42b6-a563-b953ea337c19/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/0baa833c-e4e1-449e-86ee-cafeb11f5fd5/https://www.loldrivers.io/drivers/0baa833c-e4e1-449e-86ee-cafeb11f5fd5/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/ecabc507-2cc7-4011-89ab-7d9d659e6f88/https://www.loldrivers.io/drivers/ecabc507-2cc7-4011-89ab-7d9d659e6f88/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/https://www.loldrivers.io/drivers/f22e7230-5f32-4c4e-bc9d-9076ebf10baa/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/https://www.loldrivers.io/drivers/70fa8606-c147-4c40-8b7a-980290075327/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/https://www.loldrivers.io/drivers/babe348d-f160-41ec-9db9-2413b989c1f0/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/b3fd8560-79d3-40b7-b05f-c78044176c8c/https://www.loldrivers.io/drivers/b3fd8560-79d3-40b7-b05f-c78044176c8c/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/12ccd18a-11da-495a-b4b4-98a2f2bff180/https://www.loldrivers.io/drivers/12ccd18a-11da-495a-b4b4-98a2f2bff180/Sat, 22 Jul 2023 00:00:00 GMTConfirmed vulnerable driver from Microsoft Block Listhttps://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63/Fri, 14 Jul 2023 00:00:00 GMTBad access controls in Inspect Element Ltd.'s echo_driver.sys allows attacker to gain arbitrary memory read and write, which allows for easy Privilege Escalation via Token Theft.https://www.loldrivers.io/drivers/66813e1f-13c8-4884-931a-62b46350c345/https://www.loldrivers.io/drivers/66813e1f-13c8-4884-931a-62b46350c345/Wed, 12 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/809e7c77-f0fa-46fb-862c-71969ae0c032/https://www.loldrivers.io/drivers/809e7c77-f0fa-46fb-862c-71969ae0c032/Wed, 12 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/18a842be-681a-4f32-97fd-57cb72ff5f3a/https://www.loldrivers.io/drivers/18a842be-681a-4f32-97fd-57cb72ff5f3a/Wed, 12 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/87593c63-9e3e-4d09-aa47-94bca0783396/https://www.loldrivers.io/drivers/87593c63-9e3e-4d09-aa47-94bca0783396/Wed, 12 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/b759adfa-b353-4ca3-9dfb-8fadf7a437eb/https://www.loldrivers.io/drivers/b759adfa-b353-4ca3-9dfb-8fadf7a437eb/Wed, 12 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/9713603a-53bf-4907-a304-b422db741fc6/https://www.loldrivers.io/drivers/9713603a-53bf-4907-a304-b422db741fc6/Wed, 12 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/0d039ee9-aaa5-49c2-a980-405d4290ee0a/https://www.loldrivers.io/drivers/0d039ee9-aaa5-49c2-a980-405d4290ee0a/Tue, 11 Jul 2023 00:00:00 GMTCisco Talos has identified multiple versions of an undocumented malicious driver named “RedDriver,” a driver-based browser hijacker that uses the Windows Filtering Platform (WFP) to intercept browser traffic. RedDriver has been active since at least 2021. RedDriver utilizes HookSignTool to forge its signature timestamp to bypass Windows driver-signing policies. Code from multiple open-source tools has been used in the development of RedDriver's infection chain, including HP-Socket and a custom implementation of ReflectiveLoader. The authors of RedDriver appear to be skilled in driver development and have deep knowledge of the Windows operating system. This threat appears to target native Chinese speakers, as it searches for Chinese language browsers to hijack. Additionally, the authors are likely Chinese speakers themselves.https://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/https://www.loldrivers.io/drivers/abcd2c10-1078-4cf9-b320-04ca38d22f98/Mon, 05 Jun 2023 00:00:00 GMTChaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes, work on the latest Windows versions.https://www.loldrivers.io/drivers/d3111e83-52eb-4a8c-817d-761ea72d37e2/https://www.loldrivers.io/drivers/d3111e83-52eb-4a8c-817d-761ea72d37e2/Mon, 05 Jun 2023 00:00:00 GMTBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.https://www.loldrivers.io/drivers/833fc08f-217d-4d3f-8c8e-782c61120407/https://www.loldrivers.io/drivers/833fc08f-217d-4d3f-8c8e-782c61120407/Mon, 05 Jun 2023 00:00:00 GMTBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.https://www.loldrivers.io/drivers/c734bcff-aaaa-4450-a9a9-25ee52aa7ff1/https://www.loldrivers.io/drivers/c734bcff-aaaa-4450-a9a9-25ee52aa7ff1/Mon, 05 Jun 2023 00:00:00 GMTBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.https://www.loldrivers.io/drivers/3ea63674-2599-43b5-9390-4a929ec99f48/https://www.loldrivers.io/drivers/3ea63674-2599-43b5-9390-4a929ec99f48/Mon, 05 Jun 2023 00:00:00 GMTBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.https://www.loldrivers.io/drivers/3e5c0fc4-bfe8-4af2-9613-4f56b0e3c2c8/https://www.loldrivers.io/drivers/3e5c0fc4-bfe8-4af2-9613-4f56b0e3c2c8/Mon, 05 Jun 2023 00:00:00 GMTThis demo is a presentation at the CYBERSEC 2023 in Taiwan. The presentation showcases the abuse of RTCore64.sys (CVE-2019-16098) from MSI and the nullification of the DSE flag to load a malicious unsigned driver. The presentation also demonstrates an attack on 360 Total Security by nulling out its ObRegisterCallbacks and notify callbacks, enabling the execution of any malicious behavior on the processes of 360 Total Security.https://www.loldrivers.io/drivers/8198f5af-4b40-4800-a22a-4a7cf957ef37/https://www.loldrivers.io/drivers/8198f5af-4b40-4800-a22a-4a7cf957ef37/Mon, 05 Jun 2023 00:00:00 GMTBlackCat Ransomware Deploys New Signed Kernel Driver. BlackCat ransomware incident that occurred in February 2023.https://www.loldrivers.io/drivers/61abe019-08cb-48a3-89b2-62810696f277/https://www.loldrivers.io/drivers/61abe019-08cb-48a3-89b2-62810696f277/Mon, 05 Jun 2023 00:00:00 GMTFound via RichPEHeaderHash pivoting.https://www.loldrivers.io/drivers/ddf661c0-7dfc-4c26-89c5-00cd6a81a139/https://www.loldrivers.io/drivers/ddf661c0-7dfc-4c26-89c5-00cd6a81a139/Mon, 05 Jun 2023 00:00:00 GMTwfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature). The driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.https://www.loldrivers.io/drivers/93740202-930c-4ab4-8603-8ec9532c5415/https://www.loldrivers.io/drivers/93740202-930c-4ab4-8603-8ec9532c5415/Mon, 05 Jun 2023 00:00:00 GMTWintapix.sys is partially protected by VMProtect, a software protection tool that uses virtualization to protect software applications from reverse engineering and unauthorized usage. It transforms the original executable file into a virtualized code executed in a protected environment, making it difficult to analyze and tamper with.https://www.loldrivers.io/drivers/a285591e-ad3c-46a3-a648-c58589ff5efc/https://www.loldrivers.io/drivers/a285591e-ad3c-46a3-a648-c58589ff5efc/Mon, 22 May 2023 00:00:00 GMTVulnerable driver found in https://github.com/hfiref0x/KDU.https://www.loldrivers.io/drivers/de365e80-45cb-48fb-af6e-0a96a5ad7777/https://www.loldrivers.io/drivers/de365e80-45cb-48fb-af6e-0a96a5ad7777/Mon, 22 May 2023 00:00:00 GMTThe driver is part of Dragon Center (or MSI Center?) from MSI. It creates \Device\CtiIo ACLless DO and provides access to memory and IO. The driver is signed with WHQL cert.https://www.loldrivers.io/drivers/8a162702-b043-4108-bb6c-1488751a4a32/https://www.loldrivers.io/drivers/8a162702-b043-4108-bb6c-1488751a4a32/Mon, 22 May 2023 00:00:00 GMTThe User Agent tjr.exe, which is protected via a virtual machine, drops the kernel driver to the user temporary directory C:\%User%\AppData\Local\Temp\Ktgn.sys. It then installs the dropped driver with the name ktgn and the start value = System (to start when the system restarts). From our analysis of what occurs when a user interfaces with this driver, we observed that it only uses one of the exposed Device Input and Output Control (IOCTL) code — Kill Process, which is used to kill security agent processes installed on the system.https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/Mon, 22 May 2023 00:00:00 GMTDriver used by the GMER application. Which is an application that detects and removes rootkitshttps://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/https://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/Mon, 22 May 2023 00:00:00 GMTMimidrv is a signed Windows Driver Model WDM kernel mode software driver meant to be used with the standard Mimikatz executable.https://www.loldrivers.io/drivers/cf49f43c-d7b4-4c1a-a40d-1be36ea64bff/https://www.loldrivers.io/drivers/cf49f43c-d7b4-4c1a-a40d-1be36ea64bff/Mon, 22 May 2023 00:00:00 GMTVulnerable driver found in https://github.com/hfiref0x/KDU.https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/https://www.loldrivers.io/drivers/f654ad84-c61d-477c-a0b2-d153b927dfcc/Sat, 20 May 2023 00:00:00 GMTThis is a vulnerable driver per Microsoft.https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/https://www.loldrivers.io/drivers/da7314dc-6cf1-4d74-a0d1-796fc08944f8/Sat, 20 May 2023 00:00:00 GMTThese samples are related to CopperStealth campaign found by TrendMicro. CopperStealth’s infection chain involves dropping and loading a rootkit, which later injects its payload into explorer.exe and another system process. These payloads are responsible for downloading and running additional tasks. The rootkit also blocks access to blocklisted registry keys and prevents certain executables and drivers from running.https://www.loldrivers.io/drivers/3e0bf6dc-791b-4170-8c40-427e7299d93d/https://www.loldrivers.io/drivers/3e0bf6dc-791b-4170-8c40-427e7299d93d/Fri, 12 May 2023 00:00:00 GMTKiller exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think that Killer suite is required for the NIC to work properly, so they install it even after a fresh Windows install. This version is confirmed vulnerable based on the script usage from zwclose.https://www.loldrivers.io/drivers/76b5dfae-b384-45ce-8646-b2eec6b76a1e/https://www.loldrivers.io/drivers/76b5dfae-b384-45ce-8646-b2eec6b76a1e/Fri, 12 May 2023 00:00:00 GMTKiller exposes COM interfaces that allow non-privileged users 1) to block network for any process 2) to manage any service in the OS. Killer is preinstalled to laptops equipped with Intel Killer NICs (e.g. Dell). Since Intel patched the vulnerability quietly, it's not clear which version is safe. Also, it is unclear which OEMs are affected. Dell is definitely in the list, but it is likely that other vendors with Killer NICs on board, such as Acer and MSI, are affected too. Some users think that Killer suite is required for the NIC to work properly, so they install it even after a fresh Windows install. This version is confirmed vulnerable based on the script usage from zwclose.https://www.loldrivers.io/drivers/0e8da43d-92e0-43f9-bc34-50a7d15b34bd/https://www.loldrivers.io/drivers/0e8da43d-92e0-43f9-bc34-50a7d15b34bd/Thu, 11 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d74fdf19-b4b0-4ec2-9c29-4213b064138b/https://www.loldrivers.io/drivers/d74fdf19-b4b0-4ec2-9c29-4213b064138b/Thu, 11 May 2023 00:00:00 GMTThe driver in question, identified as \\.\IREC, provides an interface for external programs to directly interact with system processes. Its key functionality is encapsulated in the OPENPROCESS function which, upon receiving a Process ID (PID), returns a handle to that specific process operating within the kernels domain. The vulnerability emerges from the indiscriminate nature of this functionality. An ill-intentioned actor can exploit this to obtain handles to critical processes like LSASS. With a hardcoded access mask of 0x410, this driver essentially grants PROCESS_QUERY_INFORMATION and PROCESS_VM_READ permissions, enabling unauthorized memory dumps from privileged processes, all from an unprivileged context.https://www.loldrivers.io/drivers/a02ee964-a21e-4b08-9c98-a730c90bfd53/https://www.loldrivers.io/drivers/a02ee964-a21e-4b08-9c98-a730c90bfd53/Thu, 11 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/c1265ee4-aed4-4e65-ac54-c64deb5e3b28/https://www.loldrivers.io/drivers/c1265ee4-aed4-4e65-ac54-c64deb5e3b28/Sun, 07 May 2023 00:00:00 GMTSophosLabs has discovered that threat actors are using a new driver loader called BURNTCIGAR to install a malicious driver signed with Microsoft.https://www.loldrivers.io/drivers/412f4aaf-5525-458c-b87e-311e504b856d/https://www.loldrivers.io/drivers/412f4aaf-5525-458c-b87e-311e504b856d/Sun, 07 May 2023 00:00:00 GMTThe criminals signed their AV-killer malware, closely related to one known as BURNTCIGAR, with a legitimate WHCP certificatehttps://www.loldrivers.io/drivers/6fe10a55-7fb8-4a9d-9ebc-1b27b6e5b833/https://www.loldrivers.io/drivers/6fe10a55-7fb8-4a9d-9ebc-1b27b6e5b833/Sun, 07 May 2023 00:00:00 GMTSigned POORTRY Sampleshttps://www.loldrivers.io/drivers/5c45ae9e-cb6f-4eab-a070-b0187202e080/https://www.loldrivers.io/drivers/5c45ae9e-cb6f-4eab-a070-b0187202e080/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/8d97bb7f-e009-4dc7-ab9d-fde293e679dc/https://www.loldrivers.io/drivers/8d97bb7f-e009-4dc7-ab9d-fde293e679dc/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/043773c5-120a-4c6b-8485-8f1f5c47fd3e/https://www.loldrivers.io/drivers/043773c5-120a-4c6b-8485-8f1f5c47fd3e/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/10b1fc3d-c444-4885-8ca9-4b5891885507/https://www.loldrivers.io/drivers/10b1fc3d-c444-4885-8ca9-4b5891885507/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/6ec5ddda-f302-4008-a73e-12814c1d571f/https://www.loldrivers.io/drivers/6ec5ddda-f302-4008-a73e-12814c1d571f/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/66be9e0a-9246-4404-b5b5-7fbde351668f/https://www.loldrivers.io/drivers/66be9e0a-9246-4404-b5b5-7fbde351668f/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/39f427b6-aad3-4cb8-b363-9113a6d53b07/https://www.loldrivers.io/drivers/39f427b6-aad3-4cb8-b363-9113a6d53b07/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/https://www.loldrivers.io/drivers/a9d9cbb7-b5f6-4e74-97a5-29993263280e/Sat, 06 May 2023 00:00:00 GMTCorsair LL Access 1.0.22.0 maps caller-selected physical addresses with MmMapIoSpace and can expose the mapped pages to user mode through MmMapLockedPagesSpecifyCache. These physical-memory access primitives can be abused for kernel tampering by an attacker able to load and open the driver.https://www.loldrivers.io/drivers/16d8962b-cf96-432f-8a43-d41f06828f56/https://www.loldrivers.io/drivers/16d8962b-cf96-432f-8a43-d41f06828f56/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/c98af16e-197f-4e66-bf94-14646bde32dd/https://www.loldrivers.io/drivers/c98af16e-197f-4e66-bf94-14646bde32dd/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/62e2a967-1f03-4225-a325-122b109208f3/https://www.loldrivers.io/drivers/62e2a967-1f03-4225-a325-122b109208f3/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ee2d68aa-1a65-4967-8627-73590b041538/https://www.loldrivers.io/drivers/ee2d68aa-1a65-4967-8627-73590b041538/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/afed9dff-245e-4875-a156-3c5584beed03/https://www.loldrivers.io/drivers/afed9dff-245e-4875-a156-3c5584beed03/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7a722cd5-69ec-4680-9f20-9387f249a891/https://www.loldrivers.io/drivers/7a722cd5-69ec-4680-9f20-9387f249a891/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/3bec7340-bd8b-43ae-8569-d81a66f01dda/https://www.loldrivers.io/drivers/3bec7340-bd8b-43ae-8569-d81a66f01dda/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/90ecbbf7-b02f-424d-8b7d-56cc9e3b5873/https://www.loldrivers.io/drivers/90ecbbf7-b02f-424d-8b7d-56cc9e3b5873/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/613b8509-18c0-4720-b489-736776b6713e/https://www.loldrivers.io/drivers/613b8509-18c0-4720-b489-736776b6713e/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/https://www.loldrivers.io/drivers/52ded752-2708-499e-8f37-98e4a9adc23c/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/56cdac8e-d87d-49c8-b281-6e096c2390d1/https://www.loldrivers.io/drivers/56cdac8e-d87d-49c8-b281-6e096c2390d1/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/13637210-2e1c-45a4-9f76-fe38c3c34264/https://www.loldrivers.io/drivers/13637210-2e1c-45a4-9f76-fe38c3c34264/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2d7c96d3-2d6c-44cd-a8a1-5239f571a24a/https://www.loldrivers.io/drivers/2d7c96d3-2d6c-44cd-a8a1-5239f571a24a/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/https://www.loldrivers.io/drivers/4dd3289c-522c-4fce-b48e-5370efc90fa1/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5261cacf-380c-4573-85ff-a643cbdf009a/https://www.loldrivers.io/drivers/5261cacf-380c-4573-85ff-a643cbdf009a/Sat, 06 May 2023 00:00:00 GMTVulnerable driving using the stolen Nvidia Certificate.https://www.loldrivers.io/drivers/73196456-40ae-4b6d-8562-07cf99458a7d/https://www.loldrivers.io/drivers/73196456-40ae-4b6d-8562-07cf99458a7d/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/eb07ef7e-0402-48eb-8e06-8fb76eda5b84/https://www.loldrivers.io/drivers/eb07ef7e-0402-48eb-8e06-8fb76eda5b84/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a0fbd397-64d5-4af2-844b-b096e08a1866/https://www.loldrivers.io/drivers/a0fbd397-64d5-4af2-844b-b096e08a1866/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/214654eb-90c4-48c8-a183-0157e50bf07f/https://www.loldrivers.io/drivers/214654eb-90c4-48c8-a183-0157e50bf07f/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/https://www.loldrivers.io/drivers/f4126206-564f-49f5-a942-2138a3131e0e/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/90afa27c-0f67-46a6-b4a9-809f55157c71/https://www.loldrivers.io/drivers/90afa27c-0f67-46a6-b4a9-809f55157c71/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7f9842a0-8118-462e-8860-227265ff4379/https://www.loldrivers.io/drivers/7f9842a0-8118-462e-8860-227265ff4379/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0567c6c4-282f-406f-9369-7f876b899c25/https://www.loldrivers.io/drivers/0567c6c4-282f-406f-9369-7f876b899c25/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/https://www.loldrivers.io/drivers/275c80c5-a67c-4536-b29e-4e481242cb01/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/https://www.loldrivers.io/drivers/b03798af-d25a-400b-9236-4643a802846f/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/https://www.loldrivers.io/drivers/a7628504-9e35-4e42-91f7-0c0a512549f4/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2ada18ae-2c52-49b6-b1a0-cf3b267f6dc7/https://www.loldrivers.io/drivers/2ada18ae-2c52-49b6-b1a0-cf3b267f6dc7/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d35cb48d-2aca-4d7d-a194-f4566183bcd9/https://www.loldrivers.io/drivers/d35cb48d-2aca-4d7d-a194-f4566183bcd9/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/https://www.loldrivers.io/drivers/79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5938df1d-9513-449f-8252-c442ddca0c2a/https://www.loldrivers.io/drivers/5938df1d-9513-449f-8252-c442ddca0c2a/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7edb5602-239f-460a-89d6-363ff1059765/https://www.loldrivers.io/drivers/7edb5602-239f-460a-89d6-363ff1059765/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2ea12acc-95b6-4f91-afb7-8ded7a2fe9d9/https://www.loldrivers.io/drivers/2ea12acc-95b6-4f91-afb7-8ded7a2fe9d9/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7b893f79-b5b0-4373-9d29-c53a21fe6fc3/https://www.loldrivers.io/drivers/7b893f79-b5b0-4373-9d29-c53a21fe6fc3/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/https://www.loldrivers.io/drivers/1ff757df-9a40-4f78-a28a-64830440abf7/Sat, 06 May 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67/Sat, 22 Apr 2023 00:00:00 GMTBattlEye Anti-Cheat BEDAISY.SYS PPL privesc.https://www.loldrivers.io/drivers/9c3c6e89-3916-498f-81e5-da057ab3ed42/https://www.loldrivers.io/drivers/9c3c6e89-3916-498f-81e5-da057ab3ed42/Sat, 22 Apr 2023 00:00:00 GMTKernel driver seen in a recent CopperStealer campaign.https://www.loldrivers.io/drivers/2c3884d3-9e4f-4519-b18b-0969612621bc/https://www.loldrivers.io/drivers/2c3884d3-9e4f-4519-b18b-0969612621bc/Sat, 15 Apr 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/c854b612-0b9f-4fc3-a7b8-a93bed7a291e/https://www.loldrivers.io/drivers/c854b612-0b9f-4fc3-a7b8-a93bed7a291e/Sat, 15 Apr 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/b1dd91b1-9ba3-4d68-a2d1-919039e18430/https://www.loldrivers.io/drivers/b1dd91b1-9ba3-4d68-a2d1-919039e18430/Fri, 14 Apr 2023 00:00:00 GMTDriveCrypt Dcr.sys vulnerability exploit for bypassing x64 DSEhttps://www.loldrivers.io/drivers/8750b245-af35-4bc6-9af3-dc858f9db64f/https://www.loldrivers.io/drivers/8750b245-af35-4bc6-9af3-dc858f9db64f/Wed, 05 Apr 2023 00:00:00 GMTThe first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality. Once the persistence is configured, the BlackLotus bootkit is executed on every system start. The bootkits goal is to deploy a kernel driver and a final user-mode component.https://www.loldrivers.io/drivers/0c0198a3-5c63-4a9b-abe9-88a810602329/https://www.loldrivers.io/drivers/0c0198a3-5c63-4a9b-abe9-88a810602329/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/05d7cfea-1fb9-4559-8837-d97b713254fe/https://www.loldrivers.io/drivers/05d7cfea-1fb9-4559-8837-d97b713254fe/Sat, 04 Mar 2023 00:00:00 GMTSentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005. This research is being released alongside Mandiant, a SentinelOne technology and incident response partner.https://www.loldrivers.io/drivers/f7f88ef4-ada4-4210-a40d-9d84142ef0fb/https://www.loldrivers.io/drivers/f7f88ef4-ada4-4210-a40d-9d84142ef0fb/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/0fc0563c-de9f-41d8-806a-748e04d57365/https://www.loldrivers.io/drivers/0fc0563c-de9f-41d8-806a-748e04d57365/Sat, 04 Mar 2023 00:00:00 GMTSentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005. This research is being released alongside Mandiant, a SentinelOne technology and incident response partner.https://www.loldrivers.io/drivers/d827f7a6-1832-4ddb-90dd-7a8cf1c7f25e/https://www.loldrivers.io/drivers/d827f7a6-1832-4ddb-90dd-7a8cf1c7f25e/Sat, 04 Mar 2023 00:00:00 GMTSentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005. This research is being released alongside Mandiant, a SentinelOne technology and incident response partner.https://www.loldrivers.io/drivers/a5ebba11-5a31-48d2-9c6d-78bba397edf1/https://www.loldrivers.io/drivers/a5ebba11-5a31-48d2-9c6d-78bba397edf1/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/25d5ebe3-e827-44a4-86fc-898844595c23/https://www.loldrivers.io/drivers/25d5ebe3-e827-44a4-86fc-898844595c23/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/2740a074-1e06-4f75-9c6a-dc57a3f85189/https://www.loldrivers.io/drivers/2740a074-1e06-4f75-9c6a-dc57a3f85189/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/618fbf89-f4e3-4b2a-a4b4-cc4bf7c180e0/https://www.loldrivers.io/drivers/618fbf89-f4e3-4b2a-a4b4-cc4bf7c180e0/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/70acea34-7ed2-42d5-885c-eca3c2de640c/https://www.loldrivers.io/drivers/70acea34-7ed2-42d5-885c-eca3c2de640c/Sat, 04 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/0eb5f4ce-12a7-4b45-b021-42b995de07c5/https://www.loldrivers.io/drivers/0eb5f4ce-12a7-4b45-b021-42b995de07c5/Fri, 03 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/7a5fe570-3b35-4fad-b7d6-7518bd5436a0/https://www.loldrivers.io/drivers/7a5fe570-3b35-4fad-b7d6-7518bd5436a0/Thu, 02 Mar 2023 00:00:00 GMTDriver categorized as POORTRY by Mandiant.https://www.loldrivers.io/drivers/7e80423f-8b30-4ee2-b904-9f5421826a8c/https://www.loldrivers.io/drivers/7e80423f-8b30-4ee2-b904-9f5421826a8c/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/1bf3b155-752a-4cc7-beb0-f202e525eb1a/https://www.loldrivers.io/drivers/1bf3b155-752a-4cc7-beb0-f202e525eb1a/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/2e1531b2-d370-4543-9e2e-5319a1c13c22/https://www.loldrivers.io/drivers/2e1531b2-d370-4543-9e2e-5319a1c13c22/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/9748d5c8-62dd-474b-a336-0aadb49e5ff9/https://www.loldrivers.io/drivers/9748d5c8-62dd-474b-a336-0aadb49e5ff9/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/f8bddc8b-49b9-41f7-a877-d15ec3f174f9/https://www.loldrivers.io/drivers/f8bddc8b-49b9-41f7-a877-d15ec3f174f9/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/0590655c-baa2-481a-b909-463534bd7a5e/https://www.loldrivers.io/drivers/0590655c-baa2-481a-b909-463534bd7a5e/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/3d1439e9-9a7d-497a-8c6c-74513f825d6a/https://www.loldrivers.io/drivers/3d1439e9-9a7d-497a-8c6c-74513f825d6a/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/ca1e8664-841f-4e4b-9e67-3f515cc249c6/https://www.loldrivers.io/drivers/ca1e8664-841f-4e4b-9e67-3f515cc249c6/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/33a9c9ae-5ca3-442d-9f0f-2615637c1c57/https://www.loldrivers.io/drivers/33a9c9ae-5ca3-442d-9f0f-2615637c1c57/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/eef1fcf4-8c54-420b-8d38-9c5f95129dcc/https://www.loldrivers.io/drivers/eef1fcf4-8c54-420b-8d38-9c5f95129dcc/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/aa687f89-4f3b-4b59-b64e-fee5e2ae2310/https://www.loldrivers.io/drivers/aa687f89-4f3b-4b59-b64e-fee5e2ae2310/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/a22104a8-126d-449f-ba3e-28678c60c587/https://www.loldrivers.io/drivers/a22104a8-126d-449f-ba3e-28678c60c587/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/72637cb1-5ca2-4ad0-a5df-20da17b231b5/https://www.loldrivers.io/drivers/72637cb1-5ca2-4ad0-a5df-20da17b231b5/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/3277cecc-f4b4-4a00-be01-9da83e013bcd/https://www.loldrivers.io/drivers/3277cecc-f4b4-4a00-be01-9da83e013bcd/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/127cde1d-905e-4c67-a2c3-04ea4deaea7d/https://www.loldrivers.io/drivers/127cde1d-905e-4c67-a2c3-04ea4deaea7d/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/892292f9-b87c-40a5-80e5-8c9b02914e8b/https://www.loldrivers.io/drivers/892292f9-b87c-40a5-80e5-8c9b02914e8b/Tue, 28 Feb 2023 00:00:00 GMTDriver used in the Daxin malware campaign.https://www.loldrivers.io/drivers/a5792a63-ba77-44ac-bd4a-134b24b01033/https://www.loldrivers.io/drivers/a5792a63-ba77-44ac-bd4a-134b24b01033/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2cc3dd4f-8a1e-4f1f-9871-0a14815949b4/https://www.loldrivers.io/drivers/2cc3dd4f-8a1e-4f1f-9871-0a14815949b4/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4137ecf0-05e7-463a-94da-47b7259d4433/https://www.loldrivers.io/drivers/4137ecf0-05e7-463a-94da-47b7259d4433/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/24fb7bab-b8c3-46ea-a370-c84d2f0ff614/https://www.loldrivers.io/drivers/24fb7bab-b8c3-46ea-a370-c84d2f0ff614/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/https://www.loldrivers.io/drivers/5943b267-64f3-40d4-8669-354f23dec122/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/https://www.loldrivers.io/drivers/4d365dd0-34c3-492e-a2bd-c16266796ae5/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/9a4fb66e-9084-4b21-9d76-a7afbe330606/https://www.loldrivers.io/drivers/9a4fb66e-9084-4b21-9d76-a7afbe330606/Mon, 09 Jan 2023 00:00:00 GMTAMD uProf AMDPowerProfiler.sys is affected by CVE-2021-26334. Insufficient access control permits lower-privileged callers to access model-specific registers, which can lead to privilege escalation and ring-0 code execution. AMD addresses the issue in the Windows uProf 3.4.494 release.https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/https://www.loldrivers.io/drivers/13973a71-412f-4a18-a2a6-476d3853f8de/Mon, 09 Jan 2023 00:00:00 GMTAMD Ryzen Master drivers affected by CVE-2023-20564 insufficiently validate IOCTL input buffers. A privileged caller can read or write memory through the exposed interface, potentially enabling arbitrary kernel execution.https://www.loldrivers.io/drivers/34fa6ba4-dc7c-4fd6-b947-8a0bb8ebd031/https://www.loldrivers.io/drivers/34fa6ba4-dc7c-4fd6-b947-8a0bb8ebd031/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ca768fc5-9b5c-4ced-90ab-fd6be9a70199/https://www.loldrivers.io/drivers/ca768fc5-9b5c-4ced-90ab-fd6be9a70199/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2651f5c4-d9e1-4b06-92be-e9e7313f87c4/https://www.loldrivers.io/drivers/2651f5c4-d9e1-4b06-92be-e9e7313f87c4/Mon, 09 Jan 2023 00:00:00 GMTASUS AsIO hardware-access drivers expose physical-memory mapping and I/O-port operations to user mode. These primitives can be abused to read or modify privileged system state and execute code in kernel context.https://www.loldrivers.io/drivers/920e3326-e5dc-446a-9993-6ec05266e0e0/https://www.loldrivers.io/drivers/920e3326-e5dc-446a-9993-6ec05266e0e0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d0048840-970f-4ad5-9a07-1d39469d721f/https://www.loldrivers.io/drivers/d0048840-970f-4ad5-9a07-1d39469d721f/Mon, 09 Jan 2023 00:00:00 GMTASUS asmmap64 is a memory-mapping driver that exposes physical-memory mapping to user mode. A privileged caller can abuse the interface to read or modify kernel and physical memory.https://www.loldrivers.io/drivers/b72f7335-6f27-42c5-85f5-ed7eb9016eac/https://www.loldrivers.io/drivers/b72f7335-6f27-42c5-85f5-ed7eb9016eac/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0258df5c-c3c1-4ed5-ba8f-846d91526ffe/https://www.loldrivers.io/drivers/0258df5c-c3c1-4ed5-ba8f-846d91526ffe/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/51c342f3-0b91-4674-8f81-bc016855f30f/https://www.loldrivers.io/drivers/51c342f3-0b91-4674-8f81-bc016855f30f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5af9abf0-d8de-4e9b-8141-e9e97a31901a/https://www.loldrivers.io/drivers/5af9abf0-d8de-4e9b-8141-e9e97a31901a/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/32ccd436-eb13-4ab3-83d4-3e5471f4e364/https://www.loldrivers.io/drivers/32ccd436-eb13-4ab3-83d4-3e5471f4e364/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/9889da50-3908-4499-a729-187295a60a0e/https://www.loldrivers.io/drivers/9889da50-3908-4499-a729-187295a60a0e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/6a50e368-1120-434b-9232-1a0702c80437/https://www.loldrivers.io/drivers/6a50e368-1120-434b-9232-1a0702c80437/Mon, 09 Jan 2023 00:00:00 GMTASRock AsrDrv106 drivers expose physical-memory mapping, contiguous memory allocation, and port-I/O primitives through user-controlled IOCTL handlers, enabling privileged manipulation of kernel memory.https://www.loldrivers.io/drivers/31797996-6973-402d-a4a0-d01ce51e02c0/https://www.loldrivers.io/drivers/31797996-6973-402d-a4a0-d01ce51e02c0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/3f39af20-802a-4909-a5de-7f6fe7aab350/https://www.loldrivers.io/drivers/3f39af20-802a-4909-a5de-7f6fe7aab350/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/19d16518-4aee-4983-ba89-dbbe0fa8a3e7/https://www.loldrivers.io/drivers/19d16518-4aee-4983-ba89-dbbe0fa8a3e7/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/https://www.loldrivers.io/drivers/19003e00-d42d-4cbe-91f3-756451bdd7da/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/57f63efb-dc43-4dba-9413-173e3e4be750/https://www.loldrivers.io/drivers/57f63efb-dc43-4dba-9413-173e3e4be750/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/57fc510a-e649-4599-b83e-8f3605e3d1d9/https://www.loldrivers.io/drivers/57fc510a-e649-4599-b83e-8f3605e3d1d9/Mon, 09 Jan 2023 00:00:00 GMTAvast and AVG Anti Rootkit driver aswArPot.sys versions before 22.1 are affected by CVE-2022-26522 and CVE-2022-26523. Double-fetch races in kernel handlers allow a non-administrator user to corrupt kernel memory and execute code in kernel context, enabling local privilege escalation and security-product bypass.https://www.loldrivers.io/drivers/a845a05c-5357-4b78-9783-16b4d34b2cb0/https://www.loldrivers.io/drivers/a845a05c-5357-4b78-9783-16b4d34b2cb0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/https://www.loldrivers.io/drivers/61514cbd-6f34-4a3e-a022-9ecbccc16feb/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/23f11e19-0776-4dd4-9c9c-7f6b60f8553f/https://www.loldrivers.io/drivers/23f11e19-0776-4dd4-9c9c-7f6b60f8553f/Mon, 09 Jan 2023 00:00:00 GMTASUS ATSZIO64.sys version 0.2.1.7 is affected by CVE-2024-33222, which permits local privilege escalation and arbitrary code execution through crafted IOCTL requests. The tracked x64 build exposes MSR read and write through IOCTLs 0x88070F88 and 0x88070F8C, maps selected ranges of \Device\PhysicalMemory, and returns physical addresses for contiguous allocations. These unrestricted hardware primitives can be used to modify kernel state.https://www.loldrivers.io/drivers/579a0516-1177-45ce-ad9e-45f53b28dcdc/https://www.loldrivers.io/drivers/579a0516-1177-45ce-ad9e-45f53b28dcdc/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/69b924ab-2e4a-4eae-8091-4151c238136e/https://www.loldrivers.io/drivers/69b924ab-2e4a-4eae-8091-4151c238136e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/adfb015a-f453-4b9e-a247-50f146209eb0/https://www.loldrivers.io/drivers/adfb015a-f453-4b9e-a247-50f146209eb0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d1441172-cc15-4a96-b782-f440bfb681e1/https://www.loldrivers.io/drivers/d1441172-cc15-4a96-b782-f440bfb681e1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/058fb356-e0ff-4f5e-8293-319feb005db2/https://www.loldrivers.io/drivers/058fb356-e0ff-4f5e-8293-319feb005db2/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4b047bb8-c605-4664-baed-25bb70e864a1/https://www.loldrivers.io/drivers/4b047bb8-c605-4664-baed-25bb70e864a1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/722772ee-a461-48ec-933d-f3df1578963e/https://www.loldrivers.io/drivers/722772ee-a461-48ec-933d-f3df1578963e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/3ac0eda2-a844-4a9d-9cfa-c25a9e05d678/https://www.loldrivers.io/drivers/3ac0eda2-a844-4a9d-9cfa-c25a9e05d678/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/https://www.loldrivers.io/drivers/4a80da66-f8f1-4af9-ba56-696cfe6c1e10/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e299b0b6-e5e2-45b3-bf0b-c008068cebfa/https://www.loldrivers.io/drivers/e299b0b6-e5e2-45b3-bf0b-c008068cebfa/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a66d0413-cc82-4f1e-bcf1-0dcf9d79f6c0/https://www.loldrivers.io/drivers/a66d0413-cc82-4f1e-bcf1-0dcf9d79f6c0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d158321b-4d56-49c5-9a18-bcff9f4a2ebe/https://www.loldrivers.io/drivers/d158321b-4d56-49c5-9a18-bcff9f4a2ebe/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/de4dd27a-1f7e-4271-98a4-55395ab6aabf/https://www.loldrivers.io/drivers/de4dd27a-1f7e-4271-98a4-55395ab6aabf/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0a2f2700-97b5-42b6-b121-38e5f03e9957/https://www.loldrivers.io/drivers/0a2f2700-97b5-42b6-b121-38e5f03e9957/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e7c958da-fd5d-40d6-975e-582c6fee7f69/https://www.loldrivers.io/drivers/e7c958da-fd5d-40d6-975e-582c6fee7f69/Mon, 09 Jan 2023 00:00:00 GMTBIOSTAR BS_RCIO64_W10 exposes IOCTLs 0x226004 and 0x226008 that map caller-selected physical addresses with MmMapIoSpace and read from or write to the mapped range. Additional IOCTLs expose raw port and PCI configuration access, providing privileged hardware-control primitives suitable for kernel tampering.https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/https://www.loldrivers.io/drivers/9e87b6b0-00ed-4259-bcd7-05e2c924d58c/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/bf01915d-045f-442c-a74e-25c56182123f/https://www.loldrivers.io/drivers/bf01915d-045f-442c-a74e-25c56182123f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/47724cc1-bf75-4ab7-a47a-355a9aa30de1/https://www.loldrivers.io/drivers/47724cc1-bf75-4ab7-a47a-355a9aa30de1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/578d4909-c2ba-4363-b6e3-98fb62d5e55c/https://www.loldrivers.io/drivers/578d4909-c2ba-4363-b6e3-98fb62d5e55c/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/204eccdf-99ca-4f2a-a325-8ebe34fd29a1/https://www.loldrivers.io/drivers/204eccdf-99ca-4f2a-a325-8ebe34fd29a1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/974de971-1f78-47b9-8049-6c34f294acd5/https://www.loldrivers.io/drivers/974de971-1f78-47b9-8049-6c34f294acd5/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/404f6db5-6be8-44a9-9898-badd56f96721/https://www.loldrivers.io/drivers/404f6db5-6be8-44a9-9898-badd56f96721/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/https://www.loldrivers.io/drivers/b51c441a-12c7-407d-9517-559cc0030cf6/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/f3215c19-8053-458c-81a5-90a74c5d2e6d/https://www.loldrivers.io/drivers/f3215c19-8053-458c-81a5-90a74c5d2e6d/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/https://www.loldrivers.io/drivers/0f21a584-6ace-4242-82cb-9766cea6973a/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ff74f03e-e4ce-4242-bfe3-60601056bb34/https://www.loldrivers.io/drivers/ff74f03e-e4ce-4242-bfe3-60601056bb34/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/c0645f0f-9b97-4fe9-811e-2e45c250c9ef/https://www.loldrivers.io/drivers/c0645f0f-9b97-4fe9-811e-2e45c250c9ef/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/https://www.loldrivers.io/drivers/de003542-80e1-4aa0-9b99-ed8647a93a6e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/https://www.loldrivers.io/drivers/0f59ce3b-20ac-41ba-8010-2abc74827eb8/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/fab98aaa-e4e7-4c4a-af65-c00d35cf66e9/https://www.loldrivers.io/drivers/fab98aaa-e4e7-4c4a-af65-c00d35cf66e9/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7a7630d6-d007-4d84-a17d-81236d9693e1/https://www.loldrivers.io/drivers/7a7630d6-d007-4d84-a17d-81236d9693e1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d05a0a6c-c037-4647-99ac-c41593190223/https://www.loldrivers.io/drivers/d05a0a6c-c037-4647-99ac-c41593190223/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/13b2424a-d337-4bc7-ad1d-2049c79906b4/https://www.loldrivers.io/drivers/13b2424a-d337-4bc7-ad1d-2049c79906b4/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/c2e70ee6-2f13-4d43-ad5a-c2bf033cc457/https://www.loldrivers.io/drivers/c2e70ee6-2f13-4d43-ad5a-c2bf033cc457/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1524a54d-520d-4fa4-a7d5-aaaa066fbfc4/https://www.loldrivers.io/drivers/1524a54d-520d-4fa4-a7d5-aaaa066fbfc4/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a4eabc75-edf6-4b74-9a24-6a26187adabf/https://www.loldrivers.io/drivers/a4eabc75-edf6-4b74-9a24-6a26187adabf/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/8d14d798-338f-471e-bacb-6d9371c0f529/https://www.loldrivers.io/drivers/8d14d798-338f-471e-bacb-6d9371c0f529/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/https://www.loldrivers.io/drivers/bb808089-5857-4df2-8998-753a7106cb44/Mon, 09 Jan 2023 00:00:00 GMTDell DBUtilDrv2.sys versions 2.5, 2.6, and 2.7 all contain a write-what-where condition allowing kernel memory read/write. Dell released v2.7 as a remediation for CVE-2021-36276 but the fix was incomplete. Rapid7 confirmed v2.7 retains the kernel memory primitive and published the dellicious PoC and a Metasploit module (post/windows/manage/dell_memory_protect) that works against both v2.5 and v2.7. Dell categorized the v2.7 issue as a weakness rather than a vulnerability, stating it requires admin privileges.https://www.loldrivers.io/drivers/dfce8b0f-d857-4808-80ef-61273c7a4183/https://www.loldrivers.io/drivers/dfce8b0f-d857-4808-80ef-61273c7a4183/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/43d0af25-c066-471f-bb73-6ce25dc7e0eb/https://www.loldrivers.io/drivers/43d0af25-c066-471f-bb73-6ce25dc7e0eb/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ce2d41fd-908f-414c-b6b5-338298f425b8/https://www.loldrivers.io/drivers/ce2d41fd-908f-414c-b6b5-338298f425b8/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/48bc2815-85ec-4436-a51a-69810c8cb171/https://www.loldrivers.io/drivers/48bc2815-85ec-4436-a51a-69810c8cb171/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d9f2c3d6-160c-4eb3-8547-894fcf810342/https://www.loldrivers.io/drivers/d9f2c3d6-160c-4eb3-8547-894fcf810342/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/670dc258-78b5-4552-a16b-b41917c86f8d/https://www.loldrivers.io/drivers/670dc258-78b5-4552-a16b-b41917c86f8d/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/https://www.loldrivers.io/drivers/855ade1f-8a9e-4c9d-ab8e-d7e409609852/Mon, 09 Jan 2023 00:00:00 GMTelbycdio.sys is a vulnerable driver. CVE-2009-0824.https://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/https://www.loldrivers.io/drivers/205721b7-b83b-414a-b4b5-8bacb4a37777/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/9b65dba4-81a0-48cc-8ff0-a4f353881062/https://www.loldrivers.io/drivers/9b65dba4-81a0-48cc-8ff0-a4f353881062/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d64167b6-f281-41d8-9535-6cb925e77aec/https://www.loldrivers.io/drivers/d64167b6-f281-41d8-9535-6cb925e77aec/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/31686f0e-3748-48c2-be09-fc8f3252e780/https://www.loldrivers.io/drivers/31686f0e-3748-48c2-be09-fc8f3252e780/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/75a933b4-82d8-4eb8-8ed5-a0a2178630a3/https://www.loldrivers.io/drivers/75a933b4-82d8-4eb8-8ed5-a0a2178630a3/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/64f3d4b0-6d2b-4275-b3d4-15d092af4092/https://www.loldrivers.io/drivers/64f3d4b0-6d2b-4275-b3d4-15d092af4092/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e6338692-90e0-41b1-9481-a47e0df144ad/https://www.loldrivers.io/drivers/e6338692-90e0-41b1-9481-a47e0df144ad/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a005e057-c84f-47cd-9b4b-5b1e51a06ab4/https://www.loldrivers.io/drivers/a005e057-c84f-47cd-9b4b-5b1e51a06ab4/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ddbd60c3-0611-4a59-894d-aec84203906f/https://www.loldrivers.io/drivers/ddbd60c3-0611-4a59-894d-aec84203906f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/86b520f6-cc90-4488-b343-168cad88010d/https://www.loldrivers.io/drivers/86b520f6-cc90-4488-b343-168cad88010d/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/067589f2-4f29-4dc4-bd50-a2e2ee57b25f/https://www.loldrivers.io/drivers/067589f2-4f29-4dc4-bd50-a2e2ee57b25f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2bea1bca-753c-4f09-bc9f-566ab0193f4a/https://www.loldrivers.io/drivers/2bea1bca-753c-4f09-bc9f-566ab0193f4a/Mon, 09 Jan 2023 00:00:00 GMTgdrv.sys is vulnerable to multiple CVEs: CVE-2018-19320, CVE-2018-19322, CVE-2018-19323, CVE-2018-19321. Read/Write Physical memory, read/write to/from IO ports, exposes ring0 memcpy-like functionality, read and write Machine Specific Registers (MSRs). Affected versions: GIGABYTE APP Center v1.05.21 and previous, AORUS GRAPHICS ENGINE v1.33 and previous, XTREME GAMING ENGINE v1.25 and previous, OC GURU II v2.08https://www.loldrivers.io/drivers/868c6920-f6cb-4088-8277-095a1358abe1/https://www.loldrivers.io/drivers/868c6920-f6cb-4088-8277-095a1358abe1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/29cb263b-b0b0-40d5-a97d-5ddf4ba79c1e/https://www.loldrivers.io/drivers/29cb263b-b0b0-40d5-a97d-5ddf4ba79c1e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7c83cb1a-a5ab-4ea0-aa69-0e9a1d09a82f/https://www.loldrivers.io/drivers/7c83cb1a-a5ab-4ea0-aa69-0e9a1d09a82f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e42cd285-4dda-4086-a696-93ab1d6f17ca/https://www.loldrivers.io/drivers/e42cd285-4dda-4086-a696-93ab1d6f17ca/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/080ff223-f8e0-49c0-a7b5-e97349cf81a0/https://www.loldrivers.io/drivers/080ff223-f8e0-49c0-a7b5-e97349cf81a0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5969b6dc-b136-480e-a527-3cb2ea2f0da9/https://www.loldrivers.io/drivers/5969b6dc-b136-480e-a527-3cb2ea2f0da9/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/3ab0d182-6365-47a7-89f4-34121e889503/https://www.loldrivers.io/drivers/3ab0d182-6365-47a7-89f4-34121e889503/Mon, 09 Jan 2023 00:00:00 GMTHuawei HwOs2Ec 1.0.0.1 exposes kernel process termination to administrative callers. In the tracked HwOs2Ec.sys build, IOCTL 0x22400C accepts a four-byte PID, rejects only PID 0 and PID 4, opens the target with full process access, and calls ZwTerminateProcess. Proofpoint observed this exact signed driver deployed by Cruciferra as an alternative BYOVD helper for tampering with endpoint security tools.https://www.loldrivers.io/drivers/e4098d7e-78b3-4da1-96cb-68b27f245e02/https://www.loldrivers.io/drivers/e4098d7e-78b3-4da1-96cb-68b27f245e02/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/https://www.loldrivers.io/drivers/e4609b54-cb25-4433-a75a-7a17f43cec00/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/https://www.loldrivers.io/drivers/91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/f4990bdd-8821-4a3c-a11a-4651e645810c/https://www.loldrivers.io/drivers/f4990bdd-8821-4a3c-a11a-4651e645810c/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/04d377f9-36e0-42a4-8d47-62232163dc68/https://www.loldrivers.io/drivers/04d377f9-36e0-42a4-8d47-62232163dc68/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/https://www.loldrivers.io/drivers/1d2cdef1-de44-4849-80e5-e2fa288df681/Mon, 09 Jan 2023 00:00:00 GMT(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.https://www.loldrivers.io/drivers/6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8/https://www.loldrivers.io/drivers/6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/https://www.loldrivers.io/drivers/fe2f68e1-e459-4802-9a9a-23bb3c2fd331/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/edd29861-6984-4dbe-8e7c-22e9b6cf68d0/https://www.loldrivers.io/drivers/edd29861-6984-4dbe-8e7c-22e9b6cf68d0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/81a73e57-2e92-4d21-97d3-1c21eb4c3aea/https://www.loldrivers.io/drivers/81a73e57-2e92-4d21-97d3-1c21eb4c3aea/Mon, 09 Jan 2023 00:00:00 GMTLenovo Diagnostics versions before 4.45 are covered by CVE-2022-3699. The vulnerable driver behavior tracked here is limited to confirmed 1.0.2.0 through 1.0.4.0 LenovoDiagnosticsDriver.sys builds. Their low-user device ACL exposes FILE_ANY_ACCESS IOCTLs 0x222010 and 0x222014, which map caller-selected physical addresses and provide unrestricted physical-memory read and write primitives. Later 3.1.0.0 code removed the write path, denied Builtin Users, and limited reads to allowlisted PCI registers, so that build is not tracked here.https://www.loldrivers.io/drivers/a8e999ee-746f-4788-9102-c1d3d2914f56/https://www.loldrivers.io/drivers/a8e999ee-746f-4788-9102-c1d3d2914f56/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1c7631f0-f92f-4be5-8ba7-3eefb0601d45/https://www.loldrivers.io/drivers/1c7631f0-f92f-4be5-8ba7-3eefb0601d45/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/https://www.loldrivers.io/drivers/2b949a0d-939f-456a-a34f-4589d7712227/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/3fb743b8-d3ed-4873-9c95-e212720dde21/https://www.loldrivers.io/drivers/3fb743b8-d3ed-4873-9c95-e212720dde21/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/47a351ee-8abe-40d8-bc2b-557390fa0945/https://www.loldrivers.io/drivers/47a351ee-8abe-40d8-bc2b-557390fa0945/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/cfd36b2e-cf96-498e-aeb6-ee20e7b33bbb/https://www.loldrivers.io/drivers/cfd36b2e-cf96-498e-aeb6-ee20e7b33bbb/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/57354c82-ff9c-4a54-8377-d195e4ff0a26/https://www.loldrivers.io/drivers/57354c82-ff9c-4a54-8377-d195e4ff0a26/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/https://www.loldrivers.io/drivers/2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ca415ed5-b611-4840-bfb2-6e1eacac33d1/https://www.loldrivers.io/drivers/ca415ed5-b611-4840-bfb2-6e1eacac33d1/Mon, 09 Jan 2023 00:00:00 GMTCVE-2018-16712https://www.loldrivers.io/drivers/4e5064b4-48d3-418c-a7a8-f0dc7ac0a176/https://www.loldrivers.io/drivers/4e5064b4-48d3-418c-a7a8-f0dc7ac0a176/Mon, 09 Jan 2023 00:00:00 GMTThe MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.https://www.loldrivers.io/drivers/6d21df78-d718-44df-b722-99eec654f5b2/https://www.loldrivers.io/drivers/6d21df78-d718-44df-b722-99eec654f5b2/Mon, 09 Jan 2023 00:00:00 GMTThe MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overflow (0x80102040, 0x80102044, 0x80102050,and 0x80102054)https://www.loldrivers.io/drivers/1a1cf88a-96d0-46cd-a24d-1535e4a5f6e3/https://www.loldrivers.io/drivers/1a1cf88a-96d0-46cd-a24d-1535e4a5f6e3/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/3bc629e8-7bf8-40c2-965b-87eb155e0065/https://www.loldrivers.io/drivers/3bc629e8-7bf8-40c2-965b-87eb155e0065/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/b7ec29c6-e151-4a9f-a293-e61f04ee6489/https://www.loldrivers.io/drivers/b7ec29c6-e151-4a9f-a293-e61f04ee6489/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d9e00cc7-a8f4-4390-a6dc-0f5423e97da4/https://www.loldrivers.io/drivers/d9e00cc7-a8f4-4390-a6dc-0f5423e97da4/Mon, 09 Jan 2023 00:00:00 GMTDriverGenius mydrivers.sys 9.2.707.1214 is affected by CVE-2023-1676. IOCTL 0x9C402088 dispatches caller-controlled values to the privileged WRMSR instruction without adequate access control. A local user can corrupt kernel state, execute code in ring 0, and elevate privileges.https://www.loldrivers.io/drivers/6fc3034f-8b40-44ef-807a-f61d3ea2dece/https://www.loldrivers.io/drivers/6fc3034f-8b40-44ef-807a-f61d3ea2dece/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d2806397-9ceb-47c8-b5f3-3aabec182ff5/https://www.loldrivers.io/drivers/d2806397-9ceb-47c8-b5f3-3aabec182ff5/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/8ff4ab50-05b7-4bfa-b994-1920c4ed4978/https://www.loldrivers.io/drivers/8ff4ab50-05b7-4bfa-b994-1920c4ed4978/Mon, 09 Jan 2023 00:00:00 GMTncpl.sys is a vulnerable driver. CVE-2013-3956.https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/https://www.loldrivers.io/drivers/f1dcb0e4-aa53-4e62-ab09-fb7b4a356916/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/30d6c39c-1d93-4101-8dd3-322ff0ab7fb3/https://www.loldrivers.io/drivers/30d6c39c-1d93-4101-8dd3-322ff0ab7fb3/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/c1ece07b-e92a-4050-95ee-90e03aa82120/https://www.loldrivers.io/drivers/c1ece07b-e92a-4050-95ee-90e03aa82120/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4f93e19c-4600-4e2e-943f-a986875fd7d2/https://www.loldrivers.io/drivers/4f93e19c-4600-4e2e-943f-a986875fd7d2/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/https://www.loldrivers.io/drivers/86cff0de-2536-4b8d-a846-a7312c569597/Mon, 09 Jan 2023 00:00:00 GMTnicm.sys is a vulnerable driver. CVE-2013-3956.https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/https://www.loldrivers.io/drivers/351ff5ca-f07b-4eb6-9300-d5d31514defb/Mon, 09 Jan 2023 00:00:00 GMTnscm.sys is a vulnerable driver. CVE-2013-3956.https://www.loldrivers.io/drivers/90e8600a-9b5c-4153-bb06-1d8fbe0ef232/https://www.loldrivers.io/drivers/90e8600a-9b5c-4153-bb06-1d8fbe0ef232/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e9b099f6-8a12-46f0-a540-40e88cf0ce17/https://www.loldrivers.io/drivers/e9b099f6-8a12-46f0-a540-40e88cf0ce17/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/cacc48e6-6ed8-431c-abee-88ee6c2dc3c1/https://www.loldrivers.io/drivers/cacc48e6-6ed8-431c-abee-88ee6c2dc3c1/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d5118882-6cdd-4b06-8bf4-e9818f16137e/https://www.loldrivers.io/drivers/d5118882-6cdd-4b06-8bf4-e9818f16137e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1d4f7a3a-786b-4a74-b34f-14d44343de9e/https://www.loldrivers.io/drivers/1d4f7a3a-786b-4a74-b34f-14d44343de9e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/193df066-c27c-4343-a4eb-ad2ac417a4cc/https://www.loldrivers.io/drivers/193df066-c27c-4343-a4eb-ad2ac417a4cc/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e71f0866-e317-44d4-a456-d6f0c555aa73/https://www.loldrivers.io/drivers/e71f0866-e317-44d4-a456-d6f0c555aa73/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/54d67d79-0268-4c5f-be7e-0f74cd20828a/https://www.loldrivers.io/drivers/54d67d79-0268-4c5f-be7e-0f74cd20828a/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a7bba474-815f-49be-bddc-4d76a64c866c/https://www.loldrivers.io/drivers/a7bba474-815f-49be-bddc-4d76a64c866c/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d55a5955-6220-4f38-ba7d-91339330fe98/https://www.loldrivers.io/drivers/d55a5955-6220-4f38-ba7d-91339330fe98/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d4664202-d1b9-44d4-97cc-fee2150082db/https://www.loldrivers.io/drivers/d4664202-d1b9-44d4-97cc-fee2150082db/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2e4fedb0-30ed-400d-b4e1-b2b2004c1607/https://www.loldrivers.io/drivers/2e4fedb0-30ed-400d-b4e1-b2b2004c1607/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/17cf4fac-88f1-467d-9f62-481d33accc5b/https://www.loldrivers.io/drivers/17cf4fac-88f1-467d-9f62-481d33accc5b/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5f70bde4-9f81-44a8-9d3e-c6c7cf65bfae/https://www.loldrivers.io/drivers/5f70bde4-9f81-44a8-9d3e-c6c7cf65bfae/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/93c84c08-4683-493d-abf7-22dc2d1cb567/https://www.loldrivers.io/drivers/93c84c08-4683-493d-abf7-22dc2d1cb567/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/cfdc5cb4-be5c-4dcc-a883-825fa72115b4/https://www.loldrivers.io/drivers/cfdc5cb4-be5c-4dcc-a883-825fa72115b4/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/40bfb01b-d251-4c2c-952e-052a89a76f5b/https://www.loldrivers.io/drivers/40bfb01b-d251-4c2c-952e-052a89a76f5b/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a261cd64-0d04-4bf5-ad73-f3bb96bf83cf/https://www.loldrivers.io/drivers/a261cd64-0d04-4bf5-ad73-f3bb96bf83cf/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/https://www.loldrivers.io/drivers/be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/47fe1aaf-02cd-4a41-8bf5-0047015a2a6e/https://www.loldrivers.io/drivers/47fe1aaf-02cd-4a41-8bf5-0047015a2a6e/Mon, 09 Jan 2023 00:00:00 GMTSupermicro phymem drivers expose direct physical-memory operations to user mode. In the tracked 2.3.0.0 build, IOCTL 0x80002000 accepts a physical address and length, maps the range with MmMapIoSpace, builds an MDL, and maps the pages to user mode with MmMapLockedPagesSpecifyCache; 0x80002004 releases the mapping. Adjacent paths provide direct physical-memory reads and port I/O. An administrator with device access can use these primitives to inspect or modify kernel state.https://www.loldrivers.io/drivers/268e87ba-ad44-4f3c-986f-26712cac68da/https://www.loldrivers.io/drivers/268e87ba-ad44-4f3c-986f-26712cac68da/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/f4c22f4d-eff8-40c5-8b31-146abe5f17b7/https://www.loldrivers.io/drivers/f4c22f4d-eff8-40c5-8b31-146abe5f17b7/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/354a9fcf-acf1-4151-94d2-af88116f605c/https://www.loldrivers.io/drivers/354a9fcf-acf1-4151-94d2-af88116f605c/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/aaa92ef1-5728-4e15-9fca-b054b02f0fb0/https://www.loldrivers.io/drivers/aaa92ef1-5728-4e15-9fca-b054b02f0fb0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/https://www.loldrivers.io/drivers/99668140-a8f6-48f8-86d1-cf3bf693600c/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0d0d204b-f6ce-4ce4-8d76-1724a1676c3f/https://www.loldrivers.io/drivers/0d0d204b-f6ce-4ce4-8d76-1724a1676c3f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/5d3f0b7d-7413-48e6-8d9c-7fc0bb5a66ee/https://www.loldrivers.io/drivers/5d3f0b7d-7413-48e6-8d9c-7fc0bb5a66ee/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd/Mon, 09 Jan 2023 00:00:00 GMTThe driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. This can be exploited for privilege escalation, code execution under high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/https://www.loldrivers.io/drivers/8d3f27bd-c3fd-48d0-913a-e2caa6fbd025/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/https://www.loldrivers.io/drivers/fbdd993b-47b1-4448-8c41-24c310802398/Mon, 09 Jan 2023 00:00:00 GMTThis utility access almost all the computer hardware, including PCI (PCI Express), PCI Index/Data, Memory, Memory Index/Data, I/O Space, I/O Index/Data, Super I/O, Clock Generator, DIMM SPD, SMBus Device, CPU MSR Registers, ATA/ATAPI Identify Data, Disk Read Write, ACPI Tables Dump (include AML decode), Embedded Controller, USB Information, SMBIOS Structures, PCI Option ROMs, MP Configuration Table, E820, EDID and Remote Access. And also a Command Window is provided to access hardware manually.https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/https://www.loldrivers.io/drivers/1c6e1d3b-f825-4065-9e0c-83386883e40f/Mon, 09 Jan 2023 00:00:00 GMTA vulnerability exists in the latest version of Razer Synapse (v2.20.15.1104 as of the day of disclosure) which can be leveraged locally by a malicious application to elevate its privileges to those of NT_AUTHORITY\SYSTEM. The vulnerability lies in a specific IOCTL handler in the rzpnk.sys driver that passes a PID specified by the user to ZwOpenProcess. CVE-2017-9769.https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/https://www.loldrivers.io/drivers/bc5e020a-ecff-43c8-b57b-ee17b5f65b21/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/https://www.loldrivers.io/drivers/d819bee2-3bff-481f-a301-acc3d1f5fe58/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/https://www.loldrivers.io/drivers/a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/142453a2-a24d-4b35-8922-6d5939f1c0fc/https://www.loldrivers.io/drivers/142453a2-a24d-4b35-8922-6d5939f1c0fc/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/19897aed-9be8-4111-a7d8-35618b9d75b3/https://www.loldrivers.io/drivers/19897aed-9be8-4111-a7d8-35618b9d75b3/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/cce291c8-4534-4362-af45-5f45cd32bd92/https://www.loldrivers.io/drivers/cce291c8-4534-4362-af45-5f45cd32bd92/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/137daca4-0d7b-48aa-8574-f7eb6ad02526/https://www.loldrivers.io/drivers/137daca4-0d7b-48aa-8574-f7eb6ad02526/Mon, 09 Jan 2023 00:00:00 GMTspeedfan.sys is a vulnerable driver. CVE-2007-5633.https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/https://www.loldrivers.io/drivers/9074a02a-b1ca-4bfb-8918-5b88e91c04a2/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/84ccb68d-ce34-4aa2-98d5-7f473c2e1b07/https://www.loldrivers.io/drivers/84ccb68d-ce34-4aa2-98d5-7f473c2e1b07/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/65660363-0080-4432-abd9-64368dac0283/https://www.loldrivers.io/drivers/65660363-0080-4432-abd9-64368dac0283/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/31a962ce-43ef-410f-873a-7ccc8f00332b/https://www.loldrivers.io/drivers/31a962ce-43ef-410f-873a-7ccc8f00332b/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7196366e-04f0-4aaf-9184-ed0a0d21a75f/https://www.loldrivers.io/drivers/7196366e-04f0-4aaf-9184-ed0a0d21a75f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/8c2fa9d1-b2b1-4ba1-bad9-60c44c2c20eb/https://www.loldrivers.io/drivers/8c2fa9d1-b2b1-4ba1-bad9-60c44c2c20eb/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/be4843ef-a2a8-4a0d-91c6-42e165800bb0/https://www.loldrivers.io/drivers/be4843ef-a2a8-4a0d-91c6-42e165800bb0/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/ad693146-4adf-4407-bb20-f2505e34c226/https://www.loldrivers.io/drivers/ad693146-4adf-4407-bb20-f2505e34c226/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/https://www.loldrivers.io/drivers/22aa985b-5fdb-4e38-9382-a496220c27ec/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/https://www.loldrivers.io/drivers/a338a9fc-9fe3-400c-9fe4-69bb7892602d/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/https://www.loldrivers.io/drivers/2da3a276-9e38-4ee6-903d-d15f7c355e7c/Mon, 09 Jan 2023 00:00:00 GMTUsed by unknown actor in Acid Rain malware. vboxdrv.sys is a vulnerable driver.https://www.loldrivers.io/drivers/c3cca618-5a7f-4a51-8785-cb328fbfb0df/https://www.loldrivers.io/drivers/c3cca618-5a7f-4a51-8785-cb328fbfb0df/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/39742f99-2180-46d7-8538-56667c935cc3/https://www.loldrivers.io/drivers/39742f99-2180-46d7-8538-56667c935cc3/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/fdf4f85b-47f4-4c98-a0d5-a6583463f565/https://www.loldrivers.io/drivers/fdf4f85b-47f4-4c98-a0d5-a6583463f565/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/4db827b1-325b-444d-9f23-171285a4d12f/https://www.loldrivers.io/drivers/4db827b1-325b-444d-9f23-171285a4d12f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7f645b95-4374-47ae-be1a-e4415308b550/https://www.loldrivers.io/drivers/7f645b95-4374-47ae-be1a-e4415308b550/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/a1d35b93-e97f-4ddd-a465-2405e804e754/https://www.loldrivers.io/drivers/a1d35b93-e97f-4ddd-a465-2405e804e754/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/b45a3fdf-592a-4cd9-81e2-8fe03d554cad/https://www.loldrivers.io/drivers/b45a3fdf-592a-4cd9-81e2-8fe03d554cad/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7437388f-821e-421f-a3c1-62ce2c725a6a/https://www.loldrivers.io/drivers/7437388f-821e-421f-a3c1-62ce2c725a6a/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/902249eb-87cb-4c01-8da7-17675d743cd7/https://www.loldrivers.io/drivers/902249eb-87cb-4c01-8da7-17675d743cd7/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/0f6c3a28-4d04-474b-a098-37383f984686/https://www.loldrivers.io/drivers/0f6c3a28-4d04-474b-a098-37383f984686/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1068f5cc-65dd-4fd0-b3d8-1d982b37405f/https://www.loldrivers.io/drivers/1068f5cc-65dd-4fd0-b3d8-1d982b37405f/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/45f2c348-bf17-40ab-8306-ef14231cc996/https://www.loldrivers.io/drivers/45f2c348-bf17-40ab-8306-ef14231cc996/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/94eb0694-29ba-4f8e-b763-86c6371db6cc/https://www.loldrivers.io/drivers/94eb0694-29ba-4f8e-b763-86c6371db6cc/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/2cfede23-67f4-4af7-830f-c95ba30a43ae/https://www.loldrivers.io/drivers/2cfede23-67f4-4af7-830f-c95ba30a43ae/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/457f8b21-202a-4a3d-a18d-b4aaded9ef02/https://www.loldrivers.io/drivers/457f8b21-202a-4a3d-a18d-b4aaded9ef02/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/1ed9d02f-17cf-43dd-9645-a54452468a5e/https://www.loldrivers.io/drivers/1ed9d02f-17cf-43dd-9645-a54452468a5e/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/b745b5da-9cd6-4b3a-badf-fbe487497705/https://www.loldrivers.io/drivers/b745b5da-9cd6-4b3a-badf-fbe487497705/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/7bb5ff05-25f8-410d-ae99-c8e8f082d24f/https://www.loldrivers.io/drivers/7bb5ff05-25f8-410d-ae99-c8e8f082d24f/Mon, 09 Jan 2023 00:00:00 GMTOpenLibSys WinRing0 hardware-access drivers expose MSR, I/O-port, and physical-memory operations to user mode. Attackers can abuse these primitives for kernel-memory access and security-control tampering.https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/https://www.loldrivers.io/drivers/b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/f93e88c2-d0e8-4347-869f-efa568955e9d/https://www.loldrivers.io/drivers/f93e88c2-d0e8-4347-869f-efa568955e9d/Mon, 09 Jan 2023 00:00:00 GMThttps://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/https://www.loldrivers.io/drivers/e5f12b82-8d07-474e-9587-8c7b3714d60c/Mon, 09 Jan 2023 00:00:00 GMT