LOLDrivers Database

Chaos-Rootkit is a x64 ring0 rootkit with process hiding, privilege escalation, and capabilities for protecting and unprotecting processes, work on the latest Windows versions.

vulnerable driver

Michael Haag

2023-06-05

Filseclab Corporation

Twister Antivirus, fildds.sys, DoS2 CVE-2023-1444 From IoControlCode 0x8011206B, a normal user can cause DoS due to writing into null address.

vulnerable driver

VirarK

2024-06-20

BIOSTAR Group

I/O Interface driver file

vulnerable driver

Michael Haag

2023-01-09

Trend Micro Inc.

TrendMicro Common Module

vulnerable driver

Michael Haag

2023-01-09

Adlice Software

This is a C# AV/EDR Killer using Rogue Anti-Malware Driver 3.3. This driver is not present in the loldrivers or Windows blocklist at the time of this writing. The only reason I'm making this public is because the company has already published a fix in version 3.4, and Microsoft will likely block this driver soon. This driver can be used in Windows 23H2 with HVCI enabled, loldrivers blocklist, or WDAC enabled. HVCI is designed to ensure the integrity of code executed in the kernel, but it cannot protect against all possible vulnerabilities or actions that can be performed through drivers or system interfaces.

vulnerable driver

ph4nt0mbyt3, Michael Haag

2023-11-10

SentinelOne has observed prominent threat actors abusing legitimately signed Microsoft drivers in active intrusions into telecommunication, BPO, MSSP, and financial services businesses. Investigations into these intrusions led to the discovery of POORTRY and STONESTOP malware, part of a small toolkit designed to terminate AV and EDR processes. We first reported our discovery to Microsoft’s Security Response Center (MSRC) in October 2022 and received an official case number (75361). Today, MSRC released an associated advisory under ADV220005. This research is being released alongside Mandiant, a SentinelOne technology and incident response partner.

malicious

Michael Haag

2023-03-04

vulnerable driver

Michael Haag

2023-01-09

No Imported Functions

FUJITSU LIMITED.

vulnerable driver

Michael Haag

2023-01-09

The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.

vulnerable driver

Takahiro Haruyama

2023-11-02

The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.

vulnerable driver

Takahiro Haruyama

2023-11-02

ASRock Incorporation

ASRock IO Driver

vulnerable driver

Michael Haag

2023-01-09

vulnerable driver

Michael Haag

2023-01-09

No Imported Functions

Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.

malicious

Michael Haag

2024-09-10

OpenLibSys.org

WinRing0

vulnerable driver

Michael Haag

2023-01-09

OpenLibSys.org

WinRing0

vulnerable driver

Michael Haag

2023-01-09

OpenLibSys.org

WinRing0

vulnerable driver

Michael Haag

2023-01-09

OpenLibSys.org

WinRing0

vulnerable driver

Michael Haag

2023-01-09

Tonec Inc.

Sophos, from time to time, has observed a threat actor deploy variants of Poortry on different machines within a single estate during an attack. These variants contain the same payload, but signed with a different certificate than the driver first seen used during the attack.

malicious

Michael Haag

2024-09-10

CPUID

CPUID Driver

vulnerable driver

Nasreddine Bencherchali

2023-05-06

CPUID

CPUID Driver

vulnerable driver

Nasreddine Bencherchali

2023-05-06