Living Off The Land Drivers
Living Off The Land Drivers is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks. The project helps security professionals stay informed and mitigate potential threats.
Top Products
Block Living‑off‑the‑Land techniques RMM tools, LOLBAS, and BYOVD with native Windows controls.
Block with MagicSwordSIEM Detections
Use the following queries to detect known vulnerable or malicious drivers (LOLDrivers) in your environment. Click a tab to switch views.
1 let LOLDrivers = externaldata (Category:string, KnownVulnerableSamples:dynamic, Verified:string ) [h@"https://www.loldrivers.io/api/drivers.json"]
2 with (
3 format=multijson,
4 ingestionMapping=@'
5[
6 {"Column":"Category","Properties":{"Path":"$.Category"}},
7 {"Column":"KnownVulnerableSamples","Properties":{"Path":"$.KnownVulnerableSamples"}},
8 {"Column":"Verified","Properties":{"Path":"$.Verified"}}
9]'
10 )
11| mv-expand KnownVulnerableSamples
12| extend SHA1 = tostring(KnownVulnerableSamples.SHA1), SHA256 = tostring(KnownVulnerableSamples.SHA256)
13;
14// you can filter the drivers further based on category or verified status
15DeviceEvents
16| where ActionType == "DriverLoad"
17| join kind=inner (LOLDrivers | where isnotempty(SHA256)) on SHA256
18| union (
19 DeviceEvents
20 | where ActionType == "DriverLoad"
21 | join kind=inner (LOLDrivers | where isnotempty(SHA1)) on SHA1
22)
Credit: Mehmet Ergene (@Cyb3rMonk). Source: Detecting Vulnerable Drivers using MDE.
1index=YOUR_INDEX sourcetype=YOUR_DRIVER_LOAD_SOURCE
2| stats min(_time) as firstTime max(_time) as lastTime count by ImageLoaded dest dvc process_hash process_path signature signature_id user_id vendor_product
3| lookup loldrivers driver_name AS ImageLoaded OUTPUT is_driver driver_description
4| search is_driver=TRUE
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| `windows_vulnerable_driver_loaded_filter`
Note: The maintained lookup CSV can be found here: splunk/security_content lookups/loldrivers.csv.
Credit: Michael Haag. Source: Windows Vulnerable Driver Loaded.
🧰 Tools (expand to view)
N
Nessus Plugin: LOLDriver Detection (Windows)
Quickly detect LOLDrivers on endpoints
PS
PowerShell: Check Vulnerable Drivers (api0cradle)
Compare local drivers with LOLDrivers JSON
Go
LOLDrivers-client (Windows)
Blazingly fast client to scan for vulnerable/malicious drivers
Y
Velociraptor: Windows.Hunter.Yara.LOLDrivers
Scan driver dirs with YARA; optional upload; defaults use rules from detections/yara
- Nessus Plugin: LOLDriver Detection (Windows)
- PowerShell: Check Vulnerable Drivers (api0cradle)
- LOLDrivers-client (Windows)
- The first blazingly fast client for LOLDrivers (Living Off The Land Drivers) by MagicSword. Scan your computer for known vulnerable and known malicious Windows drivers.
- Velociraptor: Windows.Hunter.Yara.LOLDrivers
- This artifact scans system driver directories using two user-supplied YARA rules (malware and vulnerability). If no rules are supplied, it runs encoded defaults derived from Florian Roth’s rules in detections/yara. Matching files are labeled as “malware” or “vulnerability,” and can be optionally uploaded.