# LOLDrivers: Windows Driver Catalog and Detection Rules

> LOLDrivers catalogs vulnerable and known malicious Windows drivers, with sample metadata, HVCI evidence, APIs, and defensive rules for Sigma, YARA, ClamAV, Sysmon, and WDAC. It is useful for organizations that need a reference set, but its detections should be paired with local driver inventory and policy review.

**magicsword-io/LOLDrivers** — Living Off The Land Drivers

- Repository: https://github.com/magicsword-io/LOLDrivers
- Website: https://www.loldrivers.io/
- Stars: 1,848 · Forks: 237
- Language: YARA
- License: Apache-2.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/magicsword-io-loldrivers

## What LOLDrivers catalogs

LOLDrivers addresses a Windows-specific problem: identifying kernel drivers that are vulnerable or known to be malicious. These files can matter during endpoint protection because they operate at a privileged layer, and the project records both vulnerable and malicious entries rather than limiting the repository to signed or unsigned drivers. The intended users are security teams, incident responders, detection engineers, and administrators who need a shared reference for driver research and control policy.

The README reports 702 driver entries, divided into 578 vulnerable entries and 124 malicious entries, supported by evidence from 2,407 known samples. Those figures describe the catalog presented in the repository. The live site at https://www.loldrivers.io/ exposes searchable catalog metrics, growth charts, and a driver explorer. The repository also contains structured YAML records, detection directories, an API-facing site, and older material under `old/`.

This is a reference corpus, not an endpoint scanner. It can tell a security team what known samples look like and can provide rules for those samples, but it does not by itself inventory every driver installed on a machine. That distinction matters because a clean endpoint response from a catalog-driven check does not prove that the host contains no risky or unknown driver.

## Sample metadata and HVCI evidence

The catalog organizes information around driver entries and their associated samples. According to the README, one driver entry can have several known samples with different hashes, signatures, and HVCI results. This structure preserves variation within a driver family instead of reducing it to one identifier. A security analyst can therefore compare the catalog record with a file hash or evaluate a sample's recorded load behavior.

HVCI is treated as an evidence field rather than as the project's only control decision. The site presents evidence about drivers that loaded despite Hypervisor-Enforced Code Integrity. That makes the catalog useful when an organization wants to understand why an expected platform mitigation may not remove a particular driver risk. It does not mean that a recorded HVCI result is a universal conclusion for every environment or driver version.

The source repository also includes a `YML-Template.yml` for contributors. New driver records are represented as YAML, while the public site consumes catalog data to provide search and metrics. The README does not document a rollback procedure for locally modified records, nor does it claim that the catalog contains every current driver vulnerability. Coverage is therefore bounded by the evidence submitted to the project and by the sample records available at review time.

## API, site, and detection integration

LOLDrivers provides both human-facing research and machine-readable access. The documented JSON and CSV endpoints are `/api/drivers.json` and `/api/drivers.csv`. These are useful for importing the catalog into a reporting script, building an internal inventory comparison, or generating a periodic review of known driver records. The API documentation is linked from the live site, so consumers should use that documentation for field definitions and endpoint behavior.

The detection content is divided by tool. Sigma rules support hash-based hunting and blocking workflows, YARA rules provide pattern-oriented scanning, ClamAV content is stored in `detections/av/LOLDrivers.hdb`, and Sysmon rules support telemetry-oriented collection. A WDAC policy is also available under `detections/wdac/`. The repository describes these as detection resources rather than as a complete endpoint security package. Coverage and false-positive behavior depend on the rule set selected and on the driver's observed artifacts.

The README also points to a community PowerShell LOLDriver scanner. That scanner is a different operating model from the catalog: it scans a specified Windows folder for suspicious files, while LOLDrivers supplies records and detection content based on known samples. The README names `C:\WINDOWS\inf`, `C:\WINDOWS\System32\drivers`, and `C:\WINDOWS\System32\DriverStore\FileRepository` as directories to consider scanning. The scanner is linked as a separate community script, so its behavior and maintenance are not defined by this repository's README.

## Getting started with the catalog

The README does not provide a single application installation command for the catalog or website. It directs users to the live site at https://www.loldrivers.io/ or to cloning the repository and examining its categorized directories. For a first research pass, open the site and search for a driver by the identifier used in the environment, then inspect the associated sample records and evidence. For direct repository use, clone the project and inspect `drivers/`, `detections/`, and `yaml/`; the README does not state a precise command or minimum Git version for doing so.

The following is the access point documented by the project. It is a URL, not an installation command:

```bash
https://www.loldrivers.io/
```

Open that address in a browser. A first useful result should be a searchable driver catalog rather than an executable interface. The README does not document a one-command installation for the hosted service.

The project also says that the primary website uses Astro in `website/`, with the local guide in `website/README.md` documenting Node 24, Python 3.11, public API generation, local previews, and browser checks. Those versions apply to building the website, not to using the hosted catalog. The repository's `pyproject.toml` identifies the Python data generator as `loldrivers` version `0.1.0` and requires Python `^3.10`, with dependencies including PyYAML, pandas, Jinja2, stix2, LIEF, pefile, and plyara.

For a defensive first use, select the detection format required by the existing pipeline. A team already using YARA can inspect `detections/yara`; a team using Sigma can work from `detections/sigma/`; a Windows policy program can review `detections/wdac/`. The README does not document a complete local setup procedure, so the first real use depends on whether the reader is browsing the hosted site, consuming an API, or integrating one rule set into an existing security workflow.

## Maintenance, releases, and adoption limits

The repository is not archived, and its last push was on 2026-10-15. The README describes the catalog as community-maintained and says that tagged releases package driver downloads without deploying the website. The listed releases are `v2.0.0` from 2023-07-31 and `v1.0.0` from 2023-05-08. A recent repository push does not remove the operational cost of reviewing new driver records, checking sample provenance, and updating detection pipelines.

The catalog is data-heavy. An organization adopting the rules may need to decide how frequently it imports JSON or CSV data, how it maps hashes to local assets, and whether Sigma or WDAC behavior is appropriate for its Windows fleet. New driver entries can also create alerts for files that are present but not malicious in a particular environment. The README does not describe an automatic update client, rollback process, or compatibility matrix for the site integrations.

LOLDrivers is licensed under Apache-2.0. The license permits use and modification under its terms, but organizations still need to review licensing, attribution, and policy obligations for their own distribution and internal tooling. That is a repository licensing observation, not legal advice. The larger limitation is evidentiary. A known sample record is useful when a file matches its documented characteristics, but it cannot identify every modified, repacked, or previously unseen driver.

## Conclusion

Security teams maintaining Windows fleets, driver allowlists, or incident response detections should adopt LOLDrivers as a regularly reviewed reference, while small teams without the ability to triage driver risk may find its data-heavy workflow excessive. Verify first that the catalog covers the Windows versions and driver classes deployed locally, then test the relevant Sigma, YARA, or WDAC rules against an authorized copy of the environment.

## FAQ

### What is LOLDrivers used for?

LOLDrivers is a reference catalog for vulnerable and known malicious Windows drivers. It provides driver metadata, sample evidence, APIs, and detection content for defensive analysis and policy work.

### Which detection formats does LOLDrivers provide?

The repository provides Sigma, YARA, ClamAV, and Sysmon detection resources. It also includes a WDAC policy under `detections/wdac/`.

### Can LOLDrivers scan a Windows machine?

The repository itself supplies catalog data and detection rules rather than a documented endpoint-scanning application. The README separately links to a community PowerShell scanner that can inspect specified Windows driver directories.

## Sources

- [License: Apache-2.0](https://github.com/magicsword-io/LOLDrivers/blob/main/LICENSE)
- [magicsword-io/LOLDrivers on GitHub](https://github.com/magicsword-io/LOLDrivers)
- [Project website](https://www.loldrivers.io/)
- [README](https://github.com/magicsword-io/LOLDrivers/blob/main/README.md)
- [Releases](https://github.com/magicsword-io/LOLDrivers/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/magicsword-io-loldrivers