Recently added
btfilter.sys
A vulnerable kernel driver that can be used to disable Code Integrity
VulnerableExamine driver
Living Off The Land Drivers
Know the driver.
Understand the risk.
Explore vulnerable and malicious Windows drivers. Find the hashes, examine the evidence, and put detections to work.
The catalog at a glance
Full catalog · all known samplesDriver entries
713
Vulnerable & malicious drivers
Known samples
2,430
Across 713 driver entries
Driver entries over time
Oct 2026 · 713 entries+12 added
Cumulative entries · by creation date
Use the arrow keys to explore monthly totals and additions.The HVCI coverage gap
2,430 samplesHVCI enforces Microsoft’s vulnerable driver blocklist, but known risky drivers can still load.
Explore drivers that still loadBased on per-sample catalog records, not a live comparison with the latest blocklist. Results vary by Windows and blocklist version.
/
713 driver entries
Search could not load. or browse all drivers.
| Driver / publisher | Classification | Loads with HVCI | Samples | Added |
|---|---|---|---|---|
| btfilter.sysPublisher not recorded | Vulnerable | Unknown | 2 | 2026-10-25 |
| RCFlCtrl.sysPublisher not recorded | Vulnerable | Unknown | 1 | 2026-10-25 |
| tmnciesc.sysPublisher not recorded | Vulnerable | Unknown | 1 | 2026-10-25 |
| tosrfec.sysPublisher not recorded | Vulnerable | Unknown | 1 | 2026-10-25 |
| vdk.sysPublisher not recorded | Vulnerable | Unknown | 2 | 2026-10-25 |
| virtio_rng.sysPublisher not recorded | Vulnerable | Unknown | 1 | 2026-10-25 |
| vsapint.sysPublisher not recorded | Vulnerable | Unknown | 1 | 2026-10-25 |
| libwasys.sysOPSWAT, Inc. | Vulnerable | Unknown | 2 | 2026-10-19 |
| MonProcessControl.sysHonor Device Co., Ltd. | Vulnerable | Unknown | 1 | 2026-10-19 |
| RtsUpx.sysRealtek Semiconductor Corp. | Vulnerable | Unknown | 1 | 2026-10-17 |
| heysafe_drv.sysShanxi Shiheng Rail Technology Co., Ltd | Malicious | Unknown | 1 | 2026-10-15 |
| ollama.sysPublisher not recorded | Malicious | Unknown | 1 | 2026-10-01 |
Browse all drivers1–12 of 713
Put the intelligence to work.
From a driver finding to your existing security workflow.
01 / Detect & defend
Detections & policies
Find rules, hunting queries, and block policies for your security stack.
Browse detection resources02 / Scan & investigate
Tools & integrations
Use the catalog with community clients, scanners, and investigation platforms.
LOLDrivers ClientWindows driver scanningPowerShell ScannerCompare local drivers with the catalogNessusLOLDriver Detection (Windows) pluginVelociraptorDriver hunting with YARA
Explore tools & integrations