LOLDriversTHE DRIVER THREAT CATALOG
Living Off The Land Drivers

Know the driver.
Understand the risk.

Explore vulnerable and malicious Windows drivers. Find the hashes, examine the evidence, and put detections to work.

Find a driverGet detectionsExplore tools
Recently added

libwasys.sys

OPSWAT's libwasys.sys (OESIS V4 Helper Driver) exposes process termination through IOCTL 0x22E00C on \\.\WasysControl. Jehad Abudagga's KillerLand research publishes a proof of…

VulnerableExamine driver

The catalog at a glance

Full catalog · all known samples

Known samples

2,417

Across 706 driver entries

Driver entries over time

Cumulative driver entries over time197 entries in Jan 2023, growing to 706 in Oct 2026. Monthly totals based on the creation dates of current catalog entries.0400800Jan 2023Nov 2024Oct 2026
Oct 2026 · 706 entries+5 added

Cumulative entries · by creation date

Use the arrow keys to explore monthly totals and additions.

Driver explorer / THE CATALOG

JSONCSV
/
706 driver entries
Driver / publisherClassificationHVCI TRUESamplesAdded
libwasys.sysOPSWAT, Inc.VulnerableUnknown22026-10-19
MonProcessControl.sysHonor Device Co., Ltd.VulnerableUnknown12026-10-19
RtsUpx.sysRealtek Semiconductor Corp.VulnerableUnknown12026-10-17
heysafe_drv.sysShanxi Shiheng Rail Technology Co., LtdMaliciousUnknown12026-10-15
ollama.sysPublisher not recordedMaliciousUnknown12026-10-01
IoDrv.sysTOPSTAR OVERSEAS ELECTRONICS Co.,LtdVulnerableUnknown12026-09-28
AToolsKrnl64.sysAntiy LabsVulnerableUnknown12026-09-23
BS_LED64.sysBIOSTAR GroupVulnerableUnknown12026-09-21
360FsFlt_win10.sys360.cnVulnerableUnknown22026-09-19
ccekrnl.datCOMODOVulnerableUnknown12026-09-19
sysdiag.sysBeijing Huorong Network Technology Co., Ltd.VulnerableUnknown12026-09-19
AmdTools64.sysAMDVulnerableUnknown22026-09-18

Put the intelligence to work.

From a driver finding to your existing security workflow.