Live threat intelligence
LOLDrivers Database
Search, analyze, and hunt vulnerable and malicious Windows drivers used in real-world attacks.
Updated Loading…
Toggle filters, then Apply. Search runs live as you type.
PhantomKiller
x64LENOVO · 2018-01-03
DescriptionPhantomKiller is the newly released, featured process-killer variant based on Lenovo BootRepair.sys. It is tracked separately from the base BootRepair entry: the project ships it as PhantomKiller.sys, while the underlying vulnerable driver lineage is BootRepair.sys from Lenovo PC Manager. The driver exposes \\.\BootRepair without secure DACL restrictions and accepts IOCTL 0x222014 with a 4-byte PID, then calls PsLookupProcessByProcessId, ObOpenObjectByPointer, and ZwTerminateProcess to terminate protected EDR/AV processes.
Operating System
Windows x64
Privileges
Driver load requires administrative privileges; an already loaded driver can be abused by a low-privileged user according to the project README.
Use Case
BYOVD process termination against EDR/AV protected processes.
Command
sc.exe create PhantomKiller binPath="C:\Path\to\PhantomKiller.sys" type=kernel
sc.exe start PhantomKiller
PhantomKiller.exe <pid>giveio.sys
x322026-08-29
DescriptionThe 32-bit giveio driver bundled with SpeedFan creates the \\.\giveio device and handles IRP_MJ_CREATE by applying a zeroed 8 KiB I/O permission map to the opening process through Ke386IoSetAccessProcess and Ke386SetIoAccessMap. This grants unrestricted direct access to all x86 I/O ports without validating the caller.
Operating System
32-bit Windows NT, Windows 2000, Windows XP
Privileges
Administrator required to install; opening the device grants port access without an additional caller check
Use Case
Grant a user-mode process unrestricted access to hardware I/O ports.
Command
sc.exe create giveio binPath= C:\windows\temp\giveio.sys type= kernel && sc.exe start giveiomlgbbiicaihflrnh.sys
x642023-07-22
DescriptionConfirmed vulnerable driver from Microsoft Block List
Operating System
Windows
Privileges
kernel
Use Case
Elevate privileges
CP2X72C.SYS
x32Interface Corporation · 2023-11-02
DescriptionThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create CP2X72CSYS binPath= C:\windows\temp\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYSCP2X72C
x32Interface Corporation · 2023-11-02
DescriptionThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create CP2X72CSYS binPath= C:\windows\temp\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYSCP2X72C.SYS
x64Interface Corporation · 2023-11-02
DescriptionThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create CP2X72CSYS binPath= C:\windows\temp\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYSCP2X72C.SYS
x32Interface Corporation · 2023-11-02
DescriptionThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create CP2X72CSYS binPath= C:\windows\temp\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYSCP2X72C.SYS
x64Interface Corporation · 2023-11-02
DescriptionThe Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers (237 file hashes) accepting firmware access. Six allow kernel memory access. All give full control of the devices to non-admin users. By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges. As of the time of writing in October 2023, the filenames of the vulnerable drivers have not been made public until now.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create CP2X72CSYS binPath= C:\windows\temp\CP2X72CSYS.sys type=kernel && sc.exe start CP2X72CSYSntbios.sys
x32Microsoft Corporation · 2023-02-28
DescriptionDriver used in the Daxin malware campaign.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create ntbios_2.sys binPath=C:\windows\temp \n \n \n tbios_2.sys type=kernel && sc.exe start ntbios_2.sysPCHunter.sys
x64一普明为（北京）信息技术有限公司 · 2023-01-09
DescriptionEpoolsoft Windows Information View Tools
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create PCHunter.sys binPath=C:\windows\temp\PCHunter.sys type=kernel && sc.exe start PCHunter.systest2.sys
x642023-07-22
DescriptionConfirmed vulnerable driver from Microsoft Block List
Operating System
Windows
Privileges
kernel
Use Case
Elevate privileges
netfilterdrv.sys
2023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysNo imported functions
netfilterdrv.sys
2023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysNo imported functions
netfilterdrv.sys
x642023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysnetfilterdrv.sys
x322023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysnetfilterdrv.sys
x322023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysnetfilterdrv.sys
x642023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysnetfilterdrv.sys
x642023-01-09
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create netfilterdrv.sys binPath=C:\windows\temp \n \n \n etfilterdrv.sys type=kernel type=kernel && sc.exe start netfilterdrv.sysksapi.sys
x64Kingsoft Corporation · 2025-09-18
DescriptionDriver can be used to load unsigned drivers
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create ksapi.sys binPath=C:\windows\temp\ksapi.sys type=kernel && sc.exe start ksapi.sysqu829.exe
x642026-05-05
DescriptionKernel driver signed by "Fuqing Yuntan Network Tech Co.,Ltd." (a revoked VeriSign code-signing certificate that Microsoft has flagged as abused). Multiple samples in this family produce a Cobalt Strike beacon reflective loader YARA hit (Elastic protections-artifacts ruleset Windows_Trojan_CobaltStrike) and are detected by Microsoft as Trojan:Win32/Hitbrovi.G. Samples are dropped to C:\Windows under random eight-character filenames (e.g. qu829.exe) and registered as kernel services. Both observed variants share imphash ca73883db8881686fb258a9d289e3909.
Operating System
Windows 10
Privileges
kernel
Use Case
Elevate privileges
Command
sc.exe create qu829 binPath=C:\windows\qu829.sys type=kernel && sc.exe start qu829