LOLDriversTHE DRIVER THREAT CATALOG
GitHub ↗
Living Off The Land Drivers

Know the driver.
Understand the risk.

Explore vulnerable and malicious Windows drivers. Find the hashes, examine the evidence, and put detections to work.

Find a driver ↓Get detections →Explore tools →
Recently added

AmdTools64.sys

AMD Special Tools Driver AmdTools64.sys 1.7.16.219 exposes physical-memory mapping through IOCTL 0xFFF028A4. Static analysis confirms that the handler passes a caller-supplied…

VulnerableExamine driver →
Driver entries
695
Vulnerable & malicious drivers
Known samples
2,398
Across all catalog entries
Load despite HVCI
479
Samples with a recorded TRUE result
HVCI status unknown
253
Samples without a recorded result

Driver explorer / THE CATALOG

JSON ↗CSV ↗
/
695 driver entries
Driver / publisherClassificationHVCI TRUESamplesAdded
AmdTools64.sys →AMDVulnerableUnknown12026-09-18
mbamchameleon.sys →MalwarebytesVulnerableUnknown12026-09-18
pskmad.sys →Panda Security, S.L.U.VulnerableUnknown12026-09-18
pwdrvio.sys →Publisher not recordedVulnerableUnknown12026-09-18
pxscan.sys →PrevxVulnerableUnknown12026-09-18
SakDriver.sys →Publisher not recordedMaliciousUnknown12026-09-16
kgameprotect.sys →Publisher not recordedVulnerableUnknown12026-09-11
fortimon3.sys →Fortinet IncVulnerableUnknown12026-09-09
ampg.sys →Microsoft CorporationMaliciousUnknown12026-09-08
MemLoaderCustomize.sys →Publisher not recordedMaliciousUnknown22026-09-08
PlugPlayService.sys →Publisher not recordedMaliciousUnknown22026-09-08
rksafe.sys →Publisher not recordedMaliciousUnknown12026-09-08

Put the intelligence to work.

From a driver finding to your existing security workflow.