magicsword-io/LOLDrivers resource

Health v2 · maintenance only

Adoption not part of the score

1763 stars · 223 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

LOLDrivers is a community-maintained curated dataset of vulnerable and malicious Windows drivers abused by adversaries (BYOVD attacks), with hashes, YARA rules, Sigma detections, and CSV/JSON APIs. It helps defenders detect and block known-bad drivers via SIEM queries, Sysmon configs, and hash blocklists.

Use cases

• find malicious windows drivers in my environment
• block vulnerable drivers by hash
• detect BYOVD attacks in my SIEM
• get a feed of known malicious driver hashes
• check if a driver is on a blocklist
• build sigma rules for vulnerable drivers
• hunt for abused drivers with sysmon

When to choose

• you need an up-to-date, community-maintained feed of vulnerable/malicious Windows driver hashes
• you want ready-made Sigma, YARA, ClamAV, or Sysmon detections for driver threats
• you need API access (CSV/JSON) to integrate driver intelligence into your tooling

When to avoid

• you need general-purpose antivirus or endpoint protection rather than driver-specific intelligence
• you need detection for non-Windows platforms
• you need automated remediation rather than detection data

Facets

dataset · maturity active

security vulnerability-scanning monitoring documentation security windows developer-tools windows self-hosted byovd threat-intelligence yara sigma-rules driver-blocklist siem-detections ioc-feed web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="magicsword-io/LOLDrivers")