LOLDrivers
Apache-2.0 Live malwareA curated catalogue of vulnerable and malicious Windows drivers with hashes, Sigma/YARA detections and blocklists. The repository also holds the driver binaries themselves.
Summary
Welcome to LOLDrivers (Living Off The Land Drivers), an exciting open-source project that brings together vulnerable, malicious, and known malicious Windows drivers in one comprehensive repository. Our mission is to empower organizations of all sizes with the knowledge and tools to understand and address driver-related security risks, making their systems safer and more reliable.
- Formats
yamlcsvjsonsigmayara- License
- Apache-2.0
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
Download from github.com ↗
Run this inside the isolated analysis VM, never on your own machine. Follow the repository's own download instructions from there.
Contents
4,981 files 210.0 MB repository
-
.bin2,212 -
.yml1,227 -
.md696 -
.yaml690 -
.png26 -
.py14 -
.xml14 -
.jpg9
Use it with
Commands are curated, not yet run by us.
YARA — Scan a directory of your own files recursively with one rule file from the collection.
$ yara -r sample.yar samples/
sigma-cli — Convert a Sigma rule to a Splunk search (install the backend first with `sigma plugin install splunk`).
$ sigma convert -t splunk --without-pipeline sample.yml
chainsaw — Hunt through your own EVTX logs with the collection's Sigma rules, using Chainsaw's bundled mapping file.
$ chainsaw hunt logs/ -s ./LOLDrivers/rules --mapping mappings/sigma-event-logs-all.yml
jq — Stream the records one per line to see their shape before loading them anywhere.
$ jq -c . sample.json
DuckDB — Query the file in place with SQL — DuckDB detects CSV and JSON by extension.
$ duckdb -c 'SELECT * FROM '\''sample.csv'\'' LIMIT 10'