{ "schemaVersion": 1, "generatedAt": "2026-09-18T02:08:26.467Z", "provenance": { "sources": [ { "id": "loldrivers", "url": "https://raw.githubusercontent.com/magicsword-io/LOLDrivers/main/loldrivers.io/content/api/drivers.json" }, { "id": "ms-blocklist", "url": "https://aka.ms/VulnerableDriverBlockList", "version": "10.0.29545.0" } ] }, "counts": { "drivers": 687, "samples": 2390, "blockedDrivers": 87, "hvciLoadableDrivers": 230, "hvciBypassSamples": 479, "msBlocklistSamples": 1419, "msBlockedFamilies": 250 }, "hvciStatusLegend": { "bypass": "at least one known sample loads with HVCI enabled", "none": "HVCI load status was reported for this family and no known sample loads", "not-evaluated": "upstream reported no HVCI load status for any sample of this family" }, "drivers": [ { "slug": "xyzxbqvb-rdu-gfac-sys-x64", "id": "63535f5c-9535-4bb0-ae8c-4366d40055f9", "names": [ "_xyzxbqvb.rdu_GFAC_Sys_x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#xyzxbqvb-rdu-gfac-sys-x64" }, { "slug": "1", "id": "a5792a63-ba77-44ac-bd4a-134b24b01033", "names": [ "1.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#1" }, { "slug": "1109", "id": "1adc79ba-d923-4e25-9175-77fa18e10cad", "names": [ "1109.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#1109" }, { "slug": "1fc7aeeff3ab19004d2e53eae8160ab1", "id": "aaf8ce1a-e11b-4929-96e0-5ec0666cef2c", "names": [ "1fc7aeeff3ab19004d2e53eae8160ab1.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#1fc7aeeff3ab19004d2e53eae8160ab1" }, { "slug": "2", "id": "bb1f80f3-d2fd-463e-9403-57c919bd976b", "names": [ "2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#2" }, { "slug": "2-942ca9", "id": "0c0198a3-5c63-4a9b-abe9-88a810602329", "names": [ "2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#2-942ca9" }, { "slug": "360hvm64", "id": "d4d82af5-0ac6-4d5d-944f-cf108475aba9", "names": [ "360hvm64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-04-30", "companies": [ "360安全中心" ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#360hvm64" }, { "slug": "360netmon-wfp", "id": "acb5da93-1dcc-4d16-8415-6b4b221cb4a1", "names": [ "360netmon_wfp.sys", "360netmon.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-06-22", "companies": [ "360.cn" ], "resources": [ "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/", "https://www.eset.com/us/about/newsroom/research/eset-research-gentlemen-ransomware-gang-edr-killers/", "https://github.com/magicsword-io/LOLDrivers/issues/377" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#360netmon-wfp" }, { "slug": "4", "id": "05d7cfea-1fb9-4559-8837-d97b713254fe", "names": [ "4.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#4" }, { "slug": "4118b86e490aed091b1a219dba45f332", "id": "b32d8d7d-0dc2-4d09-a306-8efc4caf1839", "names": [ "4118b86e490aed091b1a219dba45f332.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#4118b86e490aed091b1a219dba45f332" }, { "slug": "4748696211bd56c2d93c21cab91e82a5", "id": "2d6c1da6-17e2-4385-ad93-1430f83bde83", "names": [ "4748696211bd56c2d93c21cab91e82a5.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#4748696211bd56c2d93c21cab91e82a5" }, { "slug": "5a4fe297c7d42539303137b6d75b150d", "id": "75b9b0c5-dd3e-4cf3-a693-c80f2feabb6a", "names": [ "5a4fe297c7d42539303137b6d75b150d.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#5a4fe297c7d42539303137b6d75b150d" }, { "slug": "6771b13a53b9c7449d4891e427735ea2", "id": "ddca6daf-4932-4e82-ad3c-d92d47632ea4", "names": [ "6771b13a53b9c7449d4891e427735ea2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#6771b13a53b9c7449d4891e427735ea2" }, { "slug": "6c8a", "id": "54af50e5-c964-485a-9b15-d5411971a425", "names": [ "6c8a.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#6c8a" }, { "slug": "7", "id": "f7f88ef4-ada4-4210-a40d-9d84142ef0fb", "names": [ "7.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#7" }, { "slug": "80", "id": "2cc3dd4f-8a1e-4f1f-9871-0a14815949b4", "names": [ "80.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#80" }, { "slug": "81", "id": "4137ecf0-05e7-463a-94da-47b7259d4433", "names": [ "81.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#81" }, { "slug": "834761775", "id": "66813e1f-13c8-4884-931a-62b46350c345", "names": [ "834761775.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-12", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#834761775" }, { "slug": "8492937-2-driver", "id": "c95a796a-a8f6-4cfa-bc42-4936ecb59091", "names": [ "8492937_2_Driver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-26", "companies": [], "resources": [ "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#8492937-2-driver" }, { "slug": "927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11", "id": "9c4e45c8-8f99-40b4-bb73-2e1cfa813034", "names": [ "927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-08-08", "companies": [], "resources": [ "https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#927e3aef03a8355d236230cace376b3023480a40c5ac08453c07dab343dd1f11" }, { "slug": "a236e7d654cd932b7d11cb604629a2d0", "id": "2866bd72-a4b1-4764-a838-9ed0790c2631", "names": [ "a236e7d654cd932b7d11cb604629a2d0.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#a236e7d654cd932b7d11cb604629a2d0" }, { "slug": "a26363e7b02b13f2b8d697abb90cd5c3", "id": "ef6b5fe8-6c4b-4b32-8adc-c1d8a83e8558", "names": [ "a26363e7b02b13f2b8d697abb90cd5c3.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#a26363e7b02b13f2b8d697abb90cd5c3" }, { "slug": "a9df5964635ef8bd567ae487c3d214c4", "id": "ac62e709-4aa5-41f4-87b1-b811283d70d1", "names": [ "a9df5964635ef8bd567ae487c3d214c4.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#a9df5964635ef8bd567ae487c3d214c4" }, { "slug": "accellid", "id": "d9e9fab2-6b64-4c14-b1ec-7af1923c0773", "names": [ "AccelLid.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "ECSl (E) Education" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules", "https://github.com/magicsword-io/LOLDrivers/issues/355" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#accellid" }, { "slug": "ace-base", "id": "ff77b58d-e143-4f61-92de-c0d9bc0af7d5", "names": [ "ACE-BASE.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2024-22830" ], "mitreId": "T1068", "verified": true, "created": "2024-02-22", "companies": [ "ANTICHEATEXPERT.COM" ], "resources": [ "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ace-base" }, { "slug": "acpix86", "id": "fd6c52b1-aeaa-4d89-8051-91acc68c3270", "names": [ "ACPIx86.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-26", "companies": [], "resources": [ "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#acpix86" }, { "slug": "adrmdrvsys", "id": "48aeea9b-7812-4b25-9835-baaebe7dc551", "names": [ "ADRMDRVSYS.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "ADLINK Technology, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://northwave-cybersecurity.com/vulnerability-notice-adlink-pxi-platform-services?hsLang=en", "https://github.com/tijme/blackout-reloaded", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#adrmdrvsys" }, { "slug": "adv64drv", "id": "24fb7bab-b8c3-46ea-a370-c84d2f0ff614", "names": [ "ADV64DRV.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "FUJITSU LIMITED." ], "resources": [ "https://github.com/namazso/physmem_drivers", "https://github.com/Haider303/trinity-2.0-lpe", "https://medium.com/@haider303mustafa/teaccess-sys-adv64drv-sys-phymem-sys-kaslr-bypass-to-system-token-theft-69441310b7f4", "https://github.com/magicsword-io/LOLDrivers/issues/395" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#adv64drv" }, { "slug": "advcare", "id": "658a906e-82d3-4c78-a63b-ddddeeb3f452", "names": [ "AdvCare.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-13", "companies": [ "Advantech Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/306", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#advcare" }, { "slug": "afd", "id": "394f49b2-2d78-4d0d-b374-1399695455f3", "names": [ "Afd.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2023-21768", "CVE-2026-68820" ], "mitreId": "T1068", "verified": true, "created": "2024-08-21", "companies": [ "Microsoft Corporation" ], "resources": [ "https://securityintelligence.com/x-force/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21768", "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#afd" }, { "slug": "agent64", "id": "5943b267-64f3-40d4-8669-354f23dec122", "names": [ "Agent64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Phoenix Technologies" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#agent64" }, { "slug": "aida64driver", "id": "deffeb8d-c7d9-46b9-a921-7d8d096460ef", "names": [ "AIDA64Driver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#aida64driver" }, { "slug": "air-system10", "id": "0eb5f4ce-12a7-4b45-b021-42b995de07c5", "names": [ "Air_SYSTEM10.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-03", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#air-system10" }, { "slug": "alinubx", "id": "84a3007a-de5e-4622-bfc5-f05d927c3618", "names": [ "Alinubx.sys", "nvfsflt64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2026-08-27", "companies": [ "CnCrypt Foundation" ], "resources": [ "https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025", "https://github.com/magicsword-io/LOLDrivers/issues/412", "https://x.com/YungBinary/status/2092812095456936172", "https://www.elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#alinubx" }, { "slug": "alsysio64", "id": "4d365dd0-34c3-492e-a2bd-c16266796ae5", "names": [ "ALSysIO64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Arthur Liberman" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 4, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#alsysio64" }, { "slug": "amd-rpmc-biostoolcommondriver", "id": "8dbd8d1c-aa4a-418c-9bbe-0730d37d9bb5", "names": [ "Amd_RPMC_BiosToolCommonDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Advanced Micro Devices" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amd-rpmc-biostoolcommondriver" }, { "slug": "amdpowerprofiler", "id": "9a4fb66e-9084-4b21-9d76-a7afbe330606", "names": [ "AMDPowerProfiler.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2021-26334" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Advanced Micro Devices, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1016.html", "https://nvd.nist.gov/vuln/detail/CVE-2021-26334", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amdpowerprofiler" }, { "slug": "amdryzenmasterdriver", "id": "13973a71-412f-4a18-a2a6-476d3853f8de", "names": [ "AMDRyzenMasterDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Advanced Micro Devices" ], "resources": [ "Internal Research", "https://github.com/elastic/protections-artifacts/search?q=AMDRyzenMasterDriver", "https://github.com/NtGabrielGomes/CVE-2023-20564", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 11, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amdryzenmasterdriver" }, { "slug": "amifldrv64", "id": "34fa6ba4-dc7c-4fd6-b947-8a0bb8ebd031", "names": [ "amifldrv64.sys", "amifldrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "Internal Research", "https://github.com/namazso/physmem_drivers", "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 24, "hvciLoadableCount": 7, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amifldrv64" }, { "slug": "amigendrv64", "id": "5c45ae9e-cb6f-4eab-a070-b0187202e080", "names": [ "amigendrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amigendrv64" }, { "slug": "amp", "id": "ca768fc5-9b5c-4ced-90ab-fd6be9a70199", "names": [ "amp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "CYREN Inc." ], "resources": [ "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amp" }, { "slug": "ampa", "id": "ea0e7351-b65c-4c5a-9863-83b9d5efcec3", "names": [ "ampa.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [], "resources": [], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ampa" }, { "slug": "ampg", "id": "bd5bc879-6602-4338-938e-0873f71bd3d0", "names": [ "ampg.sys" ], "category": "malicious", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-09-08", "companies": [ "Microsoft Corporation" ], "resources": [ "https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ampg" }, { "slug": "amsdk", "id": "a285591e-ad3c-46a3-a648-c58589ff5efc", "names": [ "amsdk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-22", "companies": [ "Copyright 2018." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amsdk" }, { "slug": "amsdk-9d41f7", "id": "981210cb-8b84-4d37-b46e-b71059b8c438", "names": [ "amsdk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-08-28", "companies": [ "WatchDogDevelopment.com, LLC." ], "resources": [ "https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#amsdk-9d41f7" }, { "slug": "aoddriver", "id": "a3c52cbe-90ca-432c-9520-761b60e7d9cb", "names": [ "AODDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Advanced Micro Devices" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 13, "hvciLoadableCount": 6, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#aoddriver" }, { "slug": "appshopdrv103", "id": "29d2c408-c1c6-451a-acf6-eddd59969183", "names": [ "AppShopDrv103.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-22", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/222", "https://github.com/hfiref0x/KDU" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#appshopdrv103" }, { "slug": "appvkgr", "id": "fbd12dbb-434e-4950-887a-382b681e8a5a", "names": [ "AppVkgr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#appvkgr" }, { "slug": "ardrv", "id": "9eb0156e-4c43-487f-be8c-40a7b19a4279", "names": [ "ardrv.sys", "ardrv_1.sys", "ardrv_2.sys", "ardrv_3.sys", "ardrv_4.sys", "ardrv_6.sys", "ardrv_7.sys", "ardrv_8.sys", "ardrv_9.sys", "ardrv_10.sys", "ardrv_11.sys", "ardrv_13.sys", "ardrv_14.sys", "ardrv_15.sys", "ardrv_16.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2026-36425" ], "mitreId": "T1068", "verified": true, "created": "2026-06-19", "companies": [ "OPSWAT, Inc." ], "resources": [ "https://github.com/redteamfortress/CVE-2026-36425", "https://github.com/magicsword-io/LOLDrivers/issues/374", "https://www.acronis.com/en/tru/posts/cambodia-focused-cluster-uses-multi-stage-infection-chain-with-localized-lures/", "https://github.com/redteamfortress/CVE-2026-36425/tree/main/Drivers" ], "sampleCount": 16, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ardrv" }, { "slug": "argusmonitor", "id": "08fbd284-7ad2-466d-b55f-6d5a7d07aca5", "names": [ "ArgusMonitor.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-10", "companies": [ "Argotronic eGbR" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/297", "https://www.argusmonitor.com/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#argusmonitor" }, { "slug": "asas", "id": "dbb58de1-a1e5-4c7f-8fe0-4033502b1c63", "names": [ "asas.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asas" }, { "slug": "asio", "id": "2651f5c4-d9e1-4b06-92be-e9e7313f87c4", "names": [ "asio.sys", "AsIO32.sys", "AsIO3.sys", "AsIO3_64.sys", "AsIO2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Asustek Computer Inc." ], "resources": [ "Internal Research", "https://github.com/namazso/physmem_drivers", "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c", "https://github.com/magicsword-io/LOLDrivers/issues/295", "https://github.com/fluffycats31/vulnerable-drivers", "https://aka.ms/VulnerableDriverBlockList" ], "sampleCount": 37, "hvciLoadableCount": 14, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asio" }, { "slug": "asio32", "id": "920e3326-e5dc-446a-9993-6ec05266e0e0", "names": [ "ASIO32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asio32" }, { "slug": "asmio64", "id": "257d425f-f660-466c-8bee-c24cccf06daa", "names": [ "AsmIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1542, T1068", "verified": true, "created": "2023-10-12", "companies": [ "Asmedia Technology Inc." ], "resources": [ "https://github.com/ucsb-seclab/popkorn-artifact/tree/main/evaluation" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asmio64" }, { "slug": "asmmap64", "id": "d0048840-970f-4ad5-9a07-1d39469d721f", "names": [ "asmmap64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASUS", "ASUSTeK Computer Inc." ], "resources": [ "https://github.com/namazso/physmem_drivers", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asmmap64" }, { "slug": "asrautochkupddrv-1-0-32", "id": "02e4a30f-8aa8-4ff0-8e02-1bff1d0f088f", "names": [ "AsrAutoChkUpdDrv_1_0_32.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "ASRock Incorporation" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrautochkupddrv-1-0-32" }, { "slug": "asrautochkupddrv", "id": "b72f7335-6f27-42c5-85f5-ed7eb9016eac", "names": [ "AsrAutoChkUpdDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrautochkupddrv" }, { "slug": "asrcddrv", "id": "bd06e043-0f69-4212-be93-d069bf0de848", "names": [ "AsrCDDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/326", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrcddrv" }, { "slug": "asrdrv", "id": "213676bb-ffb9-4d0d-a442-8cefee63acc1", "names": [ "AsrDrv.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "ASRock Incorporation" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrdrv" }, { "slug": "asrdrv10", "id": "0258df5c-c3c1-4ed5-ba8f-846d91526ffe", "names": [ "AsrDrv10.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asrdrv10" }, { "slug": "asrdrv101", "id": "51c342f3-0b91-4674-8f81-bc016855f30f", "names": [ "AsrDrv101.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asrdrv101" }, { "slug": "asrdrv102", "id": "5af9abf0-d8de-4e9b-8141-e9e97a31901a", "names": [ "AsrDrv102.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asrdrv102" }, { "slug": "asrdrv103", "id": "32ccd436-eb13-4ab3-83d4-3e5471f4e364", "names": [ "AsrDrv103.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asrdrv103" }, { "slug": "asrdrv104", "id": "9889da50-3908-4499-a729-187295a60a0e", "names": [ "asrdrv104.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrdrv104" }, { "slug": "asrdrv106", "id": "6a50e368-1120-434b-9232-1a0702c80437", "names": [ "AsrDrv106.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://github.com/fluffycats31/vulnerable-drivers", "https://aka.ms/VulnerableDriverBlockList" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrdrv106" }, { "slug": "asrdrv107", "id": "2d3178da-ea76-4f36-93f4-d76bf846c240", "names": [ "AsrDrv107.sys", "AsrDrv107n.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2020-15368" ], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md", "https://github.com/Barakat/CVE-2020-15368" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrdrv107" }, { "slug": "asribdrv", "id": "31797996-6973-402d-a4a0-d01ce51e02c0", "names": [ "AsrIbDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "RW-Everything" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asribdrv" }, { "slug": "asromgdrv", "id": "3f39af20-802a-4909-a5de-7f6fe7aab350", "names": [ "AsrOmgDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASRock Incorporation" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asromgdrv" }, { "slug": "asrrapidstartdrv", "id": "19d16518-4aee-4983-ba89-dbbe0fa8a3e7", "names": [ "AsrRapidStartDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "RW-Everything" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrrapidstartdrv" }, { "slug": "asrsetupdrv103", "id": "19003e00-d42d-4cbe-91f3-756451bdd7da", "names": [ "AsrSetupDrv103.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "RW-Everything" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 10, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrsetupdrv103" }, { "slug": "asrsmartconnectdrv", "id": "57f63efb-dc43-4dba-9413-173e3e4be750", "names": [ "AsrSmartConnectDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "RW-Everything" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asrsmartconnectdrv" }, { "slug": "astra64", "id": "5904f3a1-2e0c-4746-8078-8ada66a5cb08", "names": [ "Astra64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-10", "companies": [ "Licensed for Sysinfo Lab" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/294", "https://eclypsium.com/research/screwed-drivers-signed-sealed-delivered/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#astra64" }, { "slug": "asupio", "id": "8d97bb7f-e009-4dc7-ab9d-fde293e679dc", "names": [ "AsUpIO.sys", "AsUpIO64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research", "https://github.com/namazso/physmem_drivers", "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.m" ], "sampleCount": 4, "hvciLoadableCount": 3, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#asupio" }, { "slug": "asussaio", "id": "207b30f5-e3da-4eb2-829f-54b946eb526a", "names": [ "AsusSAIO.sys", "ASUSSAIO" ], "category": "vulnerable driver", "cve": [ "CVE-2024-55408" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "ASUSTeK COMPUTER INC." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2024-55408", "https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55408/CVE-2024-55408_AsusSAIO.sys_README.md" ], "sampleCount": 32, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#asussaio" }, { "slug": "aswarpot", "id": "57fc510a-e649-4599-b83e-8f3605e3d1d9", "names": [ "aswArPot.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2022-26522", "CVE-2022-26523" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "AVG Technologies CZ, s.r.o.", "AVAST Software" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules", "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://www.sentinelone.com/labs/vulnerabilities-in-avast-and-avg-put-millions-at-risk/", "https://nvd.nist.gov/vuln/detail/CVE-2022-26522", "https://nvd.nist.gov/vuln/detail/CVE-2022-26523" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#aswarpot" }, { "slug": "aswarpot-5d17cb", "id": "043773c5-120a-4c6b-8485-8f1f5c47fd3e", "names": [ "aswArPot.sys", "avgArPot.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "AVG Technologies CZ, s.r.o.", "AVAST Software" ], "resources": [ "Internal Research" ], "sampleCount": 39, "hvciLoadableCount": 13, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#aswarpot-5d17cb" }, { "slug": "aswvmm", "id": "a845a05c-5357-4b78-9783-16b4d34b2cb0", "names": [ "aswVmm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "AVAST Software" ], "resources": [ "https://github.com/tanduRE/AvastHV", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#aswvmm" }, { "slug": "athpexnt", "id": "f4e00816-97a8-4c2d-b990-9812f16fe3d3", "names": [ "athpexnt.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-20", "companies": [ "AhnLab, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/255" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#athpexnt" }, { "slug": "atidsmxx", "id": "347d5d79-35e6-4438-885f-57a7c95eeb89", "names": [ "atidsmxx.sys", "AtiDCM" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "Advanced Micro Devices, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2007-4315", "https://aka.ms/VulnerableDriverBlockList" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atidsmxx" }, { "slug": "atillk64", "id": "61514cbd-6f34-4a3e-a022-9ecbccc16feb", "names": [ "atillk64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ATI Technologies Inc.", "Overclocking Tool" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atillk64" }, { "slug": "atillk64-5b8319", "id": "10b1fc3d-c444-4885-8ca9-4b5891885507", "names": [ "atillk64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "ATI Technologies Inc." ], "resources": [ "Internal Research" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atillk64-5b8319" }, { "slug": "atlaccess", "id": "fb783760-cb3f-4cf4-b4ac-8edb756b9821", "names": [ "atlAccess.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atlaccess" }, { "slug": "atomicredteamcapcom", "id": "a02e1801-f6fb-41c3-a782-05fdbed44a3c", "names": [ "atomicredteamcapcom.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atomicredteamcapcom" }, { "slug": "atszio", "id": "6ec5ddda-f302-4008-a73e-12814c1d571f", "names": [ "ATSZIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "ASUSTek Computer Inc." ], "resources": [ "Internal Research" ], "sampleCount": 9, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atszio" }, { "slug": "atszio-c1f208", "id": "23f11e19-0776-4dd4-9c9c-7f6b60f8553f", "names": [ "ATSZIO.sys", "ATSZIO64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2024-33222" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASUSTek Computer Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2024-33222", "https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33222", "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#atszio-c1f208" }, { "slug": "avalueio", "id": "4f0a65a7-9a01-40cb-8d95-0844515103e6", "names": [ "avalueio.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ " Avalue Technology Inc." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#avalueio" }, { "slug": "avkiller", "id": "7a9d34e4-c660-4388-ab61-4fd6f6bf1ad4", "names": [ "avkiller.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#avkiller" }, { "slug": "b", "id": "579a0516-1177-45ce-ad9e-45f53b28dcdc", "names": [ "b.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#b" }, { "slug": "b1", "id": "69b924ab-2e4a-4eae-8091-4151c238136e", "names": [ "b1.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#b1" }, { "slug": "b3", "id": "adfb015a-f453-4b9e-a247-50f146209eb0", "names": [ "b3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#b3" }, { "slug": "b4", "id": "d1441172-cc15-4a96-b782-f440bfb681e1", "names": [ "b4.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#b4" }, { "slug": "bandai", "id": "058fb356-e0ff-4f5e-8293-319feb005db2", "names": [ "bandai.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bandai" }, { "slug": "bdapiutil", "id": "708650ed-c497-48be-97bc-9edd48cf2a1a", "names": [ "BdApiUtil.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-12-09", "companies": [ "Baidu, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/204", "https://github.com/magicsword-io/LOLDrivers/issues/231", "https://github.com/RainbowDynamix/GoodBaiii", "https://blog.talosintelligence.com/byovd-loader-deadlock-ransomware/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bdapiutil" }, { "slug": "bdapiutil-a148fd", "id": "83b78b88-3b43-41cc-a60f-cab1a7b96978", "names": [ "BdApiUtil.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-22", "companies": [ "Baidu, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/231", "https://github.com/RainbowDynamix/GoodBaiii" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bdapiutil-a148fd" }, { "slug": "bdapiutil64", "id": "f8ed41ef-18f0-441c-99b8-def062214d0e", "names": [ "BdApiUtil64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-09-18", "companies": [ "Baidu, Inc." ], "resources": [ "https://github.com/BlackSnufkin/BYOVD", "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/", "https://github.com/magicsword-io/LOLDrivers/issues/377" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bdapiutil64" }, { "slug": "be6318413160e589080df02bb3ca6e6a", "id": "a9ab4412-d484-459b-be97-5975f5ab8094", "names": [ "be6318413160e589080df02bb3ca6e6a.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#be6318413160e589080df02bb3ca6e6a" }, { "slug": "bedaisy", "id": "db666d40-c9fa-4039-bfac-a5d7afd61b67", "names": [ "bedaisy.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-04-22", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/23", "https://infosec.exchange/@Rairii/109310279380973806" ], "sampleCount": 34, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bedaisy" }, { "slug": "bin-intigua-driver64", "id": "68810b7a-06c5-498a-bbdf-28fb4d5d9201", "names": [ "bin_intigua_driver64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Intigua" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bin-intigua-driver64" }, { "slug": "biontdrv", "id": "e6378671-986d-42a1-8e7a-717117c83751", "names": [ "BioNTdrv.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2025-0285", "CVE-2025-0286", "CVE-2025-0287", "CVE-2025-0288", "CVE-2025-0289" ], "mitreId": "T1068", "verified": true, "created": "2025-03-02", "companies": [ "Paragon Software GmbH" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://kb.cert.org/vuls/id/726882", "https://www.sdxcentral.com/alerts/paragon-partition-manager-driver-flaws-enable-privilege-escalation-and-dos-attacks/2025/02/", "https://www.bleepingcomputer.com/news/security/ransomware-gangs-exploit-paragon-partition-manager-bug-in-byovd-attacks/", "https://paragon-software.zendesk.com/hc/en-us/articles/32993902732817-IMPORTANT-Paragon-Driver-Security-Patch-for-All-Products-of-Hard-Disk-Manager-Product-Line-Biontdrv-sys" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#biontdrv" }, { "slug": "biostoolcommondriver", "id": "2d301a46-ceb6-477c-8a51-463a6ded3524", "names": [ "BiosToolCommonDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Advanced Micro Devices" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/321" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#biostoolcommondriver" }, { "slug": "black", "id": "4b047bb8-c605-4664-baed-25bb70e864a1", "names": [ "Black.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#black" }, { "slug": "blackbone", "id": "b9b835bd-b720-424b-9160-2442bc4d6e58", "names": [ "Blackbone.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#blackbone" }, { "slug": "blackbonedrv10", "id": "722772ee-a461-48ec-933d-f3df1578963e", "names": [ "BlackBoneDrv10.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#blackbonedrv10" }, { "slug": "blacklotus-driver", "id": "8750b245-af35-4bc6-9af3-dc858f9db64f", "names": [ "blacklotus_driver.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-04-05", "companies": [], "resources": [ "https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/" ], "sampleCount": 7, "hvciLoadableCount": 7, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#blacklotus-driver" }, { "slug": "bootrepair", "id": "7cc0a40d-7902-4400-9fc4-0070053991cb", "names": [ "bootrepair.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-05-19", "companies": [ "LENOVO" ], "resources": [ "https://medium.com/@jehadbudagga/phantom-killer-reverse-engineering-and-weaponizing-a-lenovo-driver-to-terminate-edr-processes-9191cd06374f", "https://github.com/redteamfortress/PhantomKiller", "https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bootrepair" }, { "slug": "bs-def", "id": "3ac0eda2-a844-4a9d-9cfa-c25a9e05d678", "names": [ "Bs_Def.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "AsusTek Computer Inc." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-def" }, { "slug": "bs-def64", "id": "4a80da66-f8f1-4af9-ba56-696cfe6c1e10", "names": [ "BS_Def64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "AsusTek Computer Inc." ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-def64" }, { "slug": "bs-flash64", "id": "e299b0b6-e5e2-45b3-bf0b-c008068cebfa", "names": [ "BS_Flash64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#bs-flash64" }, { "slug": "bs-hwmio64-w10", "id": "a66d0413-cc82-4f1e-bcf1-0dcf9d79f6c0", "names": [ "BS_HWMIO64_W10.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "BIOSTAR Group" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-hwmio64-w10" }, { "slug": "bs-hwmio64", "id": "9c4e2e75-a8be-4d2f-b016-e2a98281c8ec", "names": [ "bs_hwmio64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#bs-hwmio64" }, { "slug": "bs-hwmio64-918ff0", "id": "d158321b-4d56-49c5-9a18-bcff9f4a2ebe", "names": [ "BS_HWMIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#bs-hwmio64-918ff0" }, { "slug": "bs-i2c64", "id": "de4dd27a-1f7e-4271-98a4-55395ab6aabf", "names": [ "BS_I2c64.sys", "BS_I2cIo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "BIOSTAR Group" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-i2c64" }, { "slug": "bs-i2cio", "id": "66be9e0a-9246-4404-b5b5-7fbde351668f", "names": [ "BS_I2cIo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "BIOSTAR Group" ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-i2cio" }, { "slug": "bs-rcio", "id": "0a2f2700-97b5-42b6-b121-38e5f03e9957", "names": [ "BS_RCIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules", "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-rcio" }, { "slug": "bs-rcio64", "id": "cacf18a5-6d7d-4a63-92d4-bda386a3da18", "names": [ "bs_rcio64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-rcio64" }, { "slug": "bs-rcio64-25fff5", "id": "e7c958da-fd5d-40d6-975e-582c6fee7f69", "names": [ "BS_RCIO64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "BIOSTAR Group" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "https://github.com/elastic/protections-artifacts/blob/932baf346cc8a743f1963ad3d4565b42ed17bebe/yara/rules/Windows_VulnDriver_Biostar.yar#L54", "https://nephosec.com/cve-biostar-exploit/", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-rcio64-25fff5" }, { "slug": "bs-rciow1064", "id": "39f427b6-aad3-4cb8-b363-9113a6d53b07", "names": [ "BS_RCIOW1064.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-rciow1064" }, { "slug": "bs-rvsio64", "id": "5281b4b4-1b96-4261-8a1f-5fa22ba44d53", "names": [ "BS_RVSIO64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "BIOSTAR Group" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bs-rvsio64" }, { "slug": "bsitf", "id": "9905c737-83ad-4801-a573-8267f3aea924", "names": [ "bsitf.sys", "AsusBSItf.sys", "ASUS BIOS Flash Driver" ], "category": "vulnerable driver", "cve": [ "CVE-2024-33221" ], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "ASUSTeK COMPUTER INC.", "ASUSTek Computer Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/pull/332", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2024-33221", "https://github.com/DriverHunter/Win-Driver-EXP/tree/main/CVE-2024-33221" ], "sampleCount": 14, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bsitf" }, { "slug": "bsmem64-w10", "id": "685c38ea-6939-4b02-a250-b47dcfecf817", "names": [ "BSMEM64_W10.sys", "BSMEM" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "BIOSTAR Group" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://documents.trendmicro.com/assets/white_papers/wp-an-in-depth-look-at-windows-kernel-threats.pdf", "https://aka.ms/VulnerableDriverBlockList" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bsmem64-w10" }, { "slug": "bsmemx64", "id": "9e87b6b0-00ed-4259-bcd7-05e2c924d58c", "names": [ "BSMEMx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "BIOSTAR Group" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bsmemx64" }, { "slug": "bsmi", "id": "bf01915d-045f-442c-a74e-25c56182123f", "names": [ "BSMI.sys", "BSMIXP64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bsmi" }, { "slug": "bsmix64", "id": "47724cc1-bf75-4ab7-a47a-355a9aa30de1", "names": [ "BSMIx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#bsmix64" }, { "slug": "burntcigar", "id": "bb20edec-ecd4-4acd-9ad2-e4559748b336", "names": [ "burntcigar.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-10-09", "companies": [], "resources": [ "https://www.virustotal.com/gui/file/7c5329b842cc3eaf1ec6c11b00e09a8c5e38ad14134b40a8bae3eda0a167a919", "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/", "https://www.fortiguard.com/threat-signal-report/4920", "https://securelist.com/cuba-ransomware/110533/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#burntcigar" }, { "slug": "bw", "id": "578d4909-c2ba-4363-b6e3-98fb62d5e55c", "names": [ "bw.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#bw" }, { "slug": "bwrs", "id": "204eccdf-99ca-4f2a-a325-8ebe34fd29a1", "names": [ "bwrs.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#bwrs" }, { "slug": "bwrsh", "id": "974de971-1f78-47b9-8049-6c34f294acd5", "names": [ "bwrsh.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#bwrsh" }, { "slug": "c", "id": "404f6db5-6be8-44a9-9898-badd56f96721", "names": [ "c.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#c" }, { "slug": "c94f405c5929cfcccc8ad00b42c95083", "id": "ddefecdd-9410-46d9-8957-e23aac1aba0c", "names": [ "c94f405c5929cfcccc8ad00b42c95083.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#c94f405c5929cfcccc8ad00b42c95083" }, { "slug": "capcom", "id": "b51c441a-12c7-407d-9517-559cc0030cf6", "names": [ "capcom.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#capcom" }, { "slug": "capcom2", "id": "45c42e32-6261-43c1-bdbd-cab58da729d8", "names": [ "capcom2.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#capcom2" }, { "slug": "cardio64", "id": "97e3077a-ca57-4f45-ba7c-f63dc9c4ea32", "names": [ "CardIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-13", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/310", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cardio64" }, { "slug": "ccprotect", "id": "3e3067b0-3d74-46fe-9f57-1ae3a0293958", "names": [ "CcProtect.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [ "CnCrypt Foundation" ], "resources": [ "https://github.com/BlackSnufkin/BYOVD/tree/main/CcProtect-Killer" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ccprotect" }, { "slug": "cg6kwin2k", "id": "fda3ff67-12dc-488c-a4c2-603f5bf420bd", "names": [ "cg6kwin2k.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2024-29216" ], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "NMS Communications" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html", "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-003008.html", "https://nvd.nist.gov/vuln/detail/CVE-2024-29216", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cg6kwin2k" }, { "slug": "changsha", "id": "636d30fd-2b95-4dc2-a413-be0e43d1482c", "names": [ "changsha" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-10-09", "companies": [ "CrowdStrike, Inc." ], "resources": [ "https://www.virustotal.com/gui/file/06eccd102c9105957773b32538943531d9c39d0a504ceb3b9b155e97e3b0b134" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#changsha" }, { "slug": "chaos-rootkit", "id": "abcd2c10-1078-4cf9-b320-04ca38d22f98", "names": [ "Chaos-Rootkit.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://github.com/ZeroMemoryEx/Chaos-Rootkit" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#chaos-rootkit" }, { "slug": "chaos-rootkit-0ff406", "id": "de62baae-872d-4e9a-b6d9-b0ac99854c66", "names": [ "Chaos-Rootkit.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-06-20", "companies": [], "resources": [ "https://github.com/ZeroMemoryEx/Chaos-Rootkit" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#chaos-rootkit-0ff406" }, { "slug": "chinese-cheat-driver", "id": "98b064c4-c9ff-4cac-a6b6-a24964b70923", "names": [ "chinese_cheat_driver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/issues/351", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/facebook-media-driver-exploit", "https://medium.com/@haider303mustafa/exploiting-a-signed-vulnerable-kernel-driver-for-ring-0-privilege-escalation-678fe2054d6a" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#chinese-cheat-driver" }, { "slug": "citmdrv-amd64", "id": "f3215c19-8053-458c-81a5-90a74c5d2e6d", "names": [ "CITMDRV_AMD64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers", "https://github.com/Haider303/trinity-lpe", "https://medium.com/@haider303mustafa/fastdump-sys-citmdrv-sys-567f57e9cd20", "https://github.com/magicsword-io/LOLDrivers/issues/394" ], "sampleCount": 16, "hvciLoadableCount": 13, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#citmdrv-amd64" }, { "slug": "citmdrv-ia64", "id": "0f21a584-6ace-4242-82cb-9766cea6973a", "names": [ "CITMDRV_IA64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 20, "hvciLoadableCount": 10, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#citmdrv-ia64" }, { "slug": "cmupx", "id": "64601d77-61ea-43b7-8178-9d45dfba6022", "names": [ "CmUpx.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Realtek Semiconductor Corp." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cmupx" }, { "slug": "cndom6", "id": "2703d3dd-05f0-4ae2-83a2-2ad0939467d0", "names": [ "Cndom6.sys", "XiaoH.sys", "rwdriver.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/350" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cndom6" }, { "slug": "computerz", "id": "9bf033e4-7295-4b63-8772-638b76851741", "names": [ "ComputerZ.Sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "360.cn", "ludashi.com", "鲁大师", "Z武器", "ComputerZ" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html", "https://github.com/magicsword-io/LOLDrivers/issues/304" ], "sampleCount": 50, "hvciLoadableCount": 10, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#computerz" }, { "slug": "controlcenter", "id": "b6873d69-affe-431b-9ba8-459391386603", "names": [ "ControlCenter.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Quanta" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#controlcenter" }, { "slug": "cormem", "id": "a7c3e2d1-8f4b-4e6a-b5d9-3c1f0e7a9b82", "names": [ "CorMem.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-06", "companies": [ "Teledyne Digital Imaging Inc." ], "resources": [ "https://github.com/KeServiceDescriptorTable/cormem.sys-vulnerable-driver", "https://www.virustotal.com/gui/file/40c855d20d497823716a08a443dc85846233226985ee653770bc3b245cf2ed0f", "https://x.com/skept1kal/status/2040200734570877354" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cormem" }, { "slug": "corsairllaccess64", "id": "a9d9cbb7-b5f6-4e74-97a5-29993263280e", "names": [ "CorsairLLAccess64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Corsair Memory, Inc." ], "resources": [ "Internal Research", "https://github.com/magicsword-io/LOLDrivers/issues/302", "https://nvd.nist.gov/vuln/detail/CVE-2020-8808", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 5, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#corsairllaccess64" }, { "slug": "corsairllaccess64-1f55d6", "id": "ff74f03e-e4ce-4242-bfe3-60601056bb34", "names": [ "CorsairLLAccess64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Corsair Memory, Inc." ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://github.com/magicsword-io/LOLDrivers/issues/302" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#corsairllaccess64-1f55d6" }, { "slug": "cp2x72c", "id": "a08ee79f-801d-4b98-996f-55f6a72ac5f7", "names": [ "CP2X72C.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Interface Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 5, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cp2x72c" }, { "slug": "cpqsysio64", "id": "e41d5471-c4b8-48da-bdb7-e462008c2e78", "names": [ "cpqsysio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-13", "companies": [ "Hewlett-Packard", "Hewlett Packard Enterprise" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/311", "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cpqsysio64" }, { "slug": "cpupress", "id": "c0645f0f-9b97-4fe9-811e-2e45c250c9ef", "names": [ "cpupress.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#cpupress" }, { "slug": "cpuz-x64", "id": "de003542-80e1-4aa0-9b99-ed8647a93a6e", "names": [ "cpuz_x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows (R) Server 2003 DDK provider" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cpuz-x64" }, { "slug": "cpuz", "id": "0f59ce3b-20ac-41ba-8010-2abc74827eb8", "names": [ "cpuz.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "CPUID", "Windows (R) Codename Longhorn DDK provider", "Windows (R) Win 7 DDK provider", "Windows (R) Server 2003 DDK provider" ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 100, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cpuz" }, { "slug": "cpuz-5192c9", "id": "16d8962b-cf96-432f-8a43-d41f06828f56", "names": [ "cpuz.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "CPUID", "Windows (R) Win 7 DDK provider", "Windows (R) Codename Longhorn DDK provider" ], "resources": [ "Internal Research" ], "sampleCount": 45, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cpuz-5192c9" }, { "slug": "cpuz141", "id": "fab98aaa-e4e7-4c4a-af65-c00d35cf66e9", "names": [ "cpuz141.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "CPUID" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cpuz141" }, { "slug": "csagent", "id": "6c84d133-c619-4deb-a91a-5cf05e4cb7c2", "names": [ "CSAgent.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2026-03-20", "companies": [ "CrowdStrike, Inc." ], "resources": [ "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#csagent" }, { "slug": "csagent-1f3f72", "id": "ca6455d1-b06e-496c-be33-f89c41b27540", "names": [ "CSAgent.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-26", "companies": [ "CrowdStrike, Inc." ], "resources": [ "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#csagent-1f3f72" }, { "slug": "csagent-5604cf", "id": "9974b134-7fee-4c7a-9b0d-38b3b2d7e957", "names": [ "CSAgent.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-26", "companies": [ "CrowdStrike, Inc." ], "resources": [ "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#csagent-5604cf" }, { "slug": "csagent-f7c53a", "id": "8e673a36-4f16-4f4c-acf7-ca95bc586384", "names": [ "CSAgent.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-08-08", "companies": [ "CrowdStrike, Inc." ], "resources": [ "https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#csagent-f7c53a" }, { "slug": "csc", "id": "1c92e1bf-103b-4545-b242-e5a9858ec9c8", "names": [ "CSC.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2024-26229" ], "mitreId": "T1068", "verified": true, "created": "2024-08-21", "companies": [ "Microsoft Corporation" ], "resources": [ "https://github.com/varwara/CVE-2024-26229/tree/main", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229", "https://github.com/zer0condition/ZeroHVCI" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#csc" }, { "slug": "ctiio64", "id": "de365e80-45cb-48fb-af6e-0a96a5ad7777", "names": [ "CtiIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-22", "companies": [ "Creative Technology Innovation Co., LTd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/pull/81" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ctiio64" }, { "slug": "cupfixerx64", "id": "c98af16e-197f-4e66-bf94-14646bde32dd", "names": [ "CupFixerx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cupfixerx64" }, { "slug": "cyvrlpc", "id": "85f8ad5b-c5aa-468b-99f3-4b0aacfaa724", "names": [ "cyvrlpc.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-08-08", "companies": [ "Palo Alto Networks, Inc." ], "resources": [ "https://news.sophos.com/en-us/2025/08/06/shared-secret-edr-killer-in-the-kill-chain/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#cyvrlpc" }, { "slug": "d", "id": "7a7630d6-d007-4d84-a17d-81236d9693e1", "names": [ "d.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#d" }, { "slug": "d2", "id": "d05a0a6c-c037-4647-99ac-c41593190223", "names": [ "d2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#d2" }, { "slug": "d3", "id": "13b2424a-d337-4bc7-ad1d-2049c79906b4", "names": [ "d3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#d3" }, { "slug": "d39duiy9sxtdsiu4lsvs", "id": "3207f14b-a66c-4d5e-a5d5-2467ffd58265", "names": [ "d39DuiY9sxtDSiu4LSvS.sys", "wifis.sys" ], "category": "malicious", "cve": [], "mitreId": "T1547.006", "verified": true, "created": "2026-08-29", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/400" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#d39duiy9sxtdsiu4lsvs" }, { "slug": "d4", "id": "c2e70ee6-2f13-4d43-ad5a-c2bf033cc457", "names": [ "d4.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#d4" }, { "slug": "d591004", "id": "c22dd43e-cf1f-4338-a109-d662198ffbe9", "names": [ "d591004.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#d591004" }, { "slug": "daxin-blank", "id": "7e80423f-8b30-4ee2-b904-9f5421826a8c", "names": [ "daxin_blank.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank" }, { "slug": "daxin-blank1", "id": "1bf3b155-752a-4cc7-beb0-f202e525eb1a", "names": [ "daxin_blank1.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank1" }, { "slug": "daxin-blank2", "id": "2e1531b2-d370-4543-9e2e-5319a1c13c22", "names": [ "daxin_blank2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank2" }, { "slug": "daxin-blank3", "id": "9748d5c8-62dd-474b-a336-0aadb49e5ff9", "names": [ "daxin_blank3.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank3" }, { "slug": "daxin-blank4", "id": "f8bddc8b-49b9-41f7-a877-d15ec3f174f9", "names": [ "daxin_blank4.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank4" }, { "slug": "daxin-blank5", "id": "0590655c-baa2-481a-b909-463534bd7a5e", "names": [ "daxin_blank5.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank5" }, { "slug": "daxin-blank6", "id": "3d1439e9-9a7d-497a-8c6c-74513f825d6a", "names": [ "daxin_blank6.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#daxin-blank6" }, { "slug": "dbk64", "id": "1524a54d-520d-4fa4-a7d5-aaaa066fbfc4", "names": [ "dbk64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dbk64" }, { "slug": "dbutil-2-3", "id": "a4eabc75-edf6-4b74-9a24-6a26187adabf", "names": [ "dbutil_2_3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers", "https://www.sentinelone.com/labs/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/" ], "sampleCount": 4, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dbutil-2-3" }, { "slug": "dbutil", "id": "8d14d798-338f-471e-bacb-6d9371c0f529", "names": [ "dbutil.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dbutil" }, { "slug": "dbutildrv2", "id": "bb808089-5857-4df2-8998-753a7106cb44", "names": [ "DBUtilDrv2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Dell" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "https://www.bleepingcomputer.com/news/security/dell-driver-fix-still-allows-windows-kernel-level-attacks/", "https://www.rapid7.com/db/modules/post/windows/manage/dell_memory_protect/" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dbutildrv2" }, { "slug": "dcprotect", "id": "7cee2ce8-7881-4a9a-bb18-61587c95f4a2", "names": [ "DcProtect.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-30", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/154", "https://www.virustotal.com/gui/user/slipstream" ], "sampleCount": 8, "hvciLoadableCount": 8, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dcprotect" }, { "slug": "dcr", "id": "b1dd91b1-9ba3-4d68-a2d1-919039e18430", "names": [ "dcr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-04-14", "companies": [], "resources": [ "https://github.com/wjcsharp/DriveCrypt" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dcr" }, { "slug": "dcrcvdrv", "id": "89643454-e38b-41cb-853d-abf649a104a5", "names": [ "DCRCVDrv.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2026-08-27", "companies": [ "MOCOMSYS & DCRC" ], "resources": [ "https://www.esentire.com/blog/malware-as-a-service-cocktail-errtraffic-and-cruciferra-killing-your-edr-since-2025", "https://github.com/magicsword-io/LOLDrivers/issues/412", "https://www.elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dcrcvdrv" }, { "slug": "dddriver", "id": "6f6aedb9-aeaf-4c13-9d6d-37f062728c38", "names": [ "DDDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Dell Computer Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dddriver" }, { "slug": "dddriver64dcsa", "id": "705330b3-5e2c-4c87-ab92-0f01b68b1b2d", "names": [ "dddriver64Dcsa.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Dell Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dddriver64dcsa" }, { "slug": "dellbios", "id": "fa612342-5ae0-4e69-ad9c-14d574d9fb1e", "names": [ "dellbios.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 11, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dellbios" }, { "slug": "dellinstrumentation", "id": "86b9c8d6-9c59-4fd4-befd-ab9a36a19e36", "names": [ "dellinstrumentation.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-01-13", "companies": [ "Dell" ], "resources": [ "https://dor00tkit.github.io/Dor00tkit/posts/from-admin-to-kernel-one-year-one-driver-zero-attention/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dellinstrumentation" }, { "slug": "deresute64", "id": "dbd78de7-f5ab-4fb7-a246-39cbcca4678c", "names": [ "deresute64.sys", "andappsvc2_64.sys", "usrdrv018064.sys", "usrdrv017764.sys", "usrdrv017864.sys", "wfs64.sys", "usrdrv118064.sys", "Umamusume64_2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-05-05", "companies": [], "resources": [ "https://x.com/nextronresearch/status/2051653303893680456" ], "sampleCount": 8, "hvciLoadableCount": 8, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#deresute64" }, { "slug": "devhost", "id": "d0cc79b2-a789-4cf3-9a88-25bdabb79416", "names": [ "devhost.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-22", "companies": [], "resources": [ "https://x.com/nextaboratory/status/1914729845602783262" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#devhost" }, { "slug": "devmemdrv", "id": "f375e53d-db7c-4149-beff-c8b9329f6f9b", "names": [ "devMemDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Acculogic Inc" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#devmemdrv" }, { "slug": "dh-kernel-10", "id": "dfce8b0f-d857-4808-80ef-61273c7a4183", "names": [ "Dh_Kernel_10.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "YY Inc." ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dh-kernel-10" }, { "slug": "dh-kernel", "id": "43d0af25-c066-471f-bb73-6ce25dc7e0eb", "names": [ "Dh_Kernel.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "YY Inc." ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dh-kernel" }, { "slug": "directio", "id": "a2c3f6e9-25a5-4b75-8c6b-ad2d4e155822", "names": [ "directio.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio" }, { "slug": "directio-0ac314", "id": "62e2a967-1f03-4225-a325-122b109208f3", "names": [ "DirectIo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 6, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio-0ac314" }, { "slug": "directio-1dbac6", "id": "ce2d41fd-908f-414c-b6b5-338298f425b8", "names": [ "DirectIo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio-1dbac6" }, { "slug": "directio32-legacy", "id": "7a0842ca-1a64-4ad1-9d66-25eb983d1742", "names": [ "directio32_legacy.sys", "DirectIo32.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio32-legacy" }, { "slug": "directio32", "id": "ee2d68aa-1a65-4967-8627-73590b041538", "names": [ "DirectIo32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 8, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio32" }, { "slug": "directio64", "id": "afed9dff-245e-4875-a156-3c5584beed03", "names": [ "directio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 10, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio64" }, { "slug": "directio64-9b33f8", "id": "a254e684-f6eb-40c4-a50a-7b76feb6cc02", "names": [ "directio64.sys", "utiA2D4.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2025-52347" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c", "https://github.com/floppywiggler/directio64-disclosure" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#directio64-9b33f8" }, { "slug": "ditpio64", "id": "843a028a-e998-42cb-874c-4478680af397", "names": [ "ditpio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ditpio64" }, { "slug": "dkrtk", "id": "8a162702-b043-4108-bb6c-1488751a4a32", "names": [ "dkrTK.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-22", "companies": [], "resources": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver/indicators-blackcat-ransomware-deploys-new-signed-kernel-driver.txt", "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dkrtk" }, { "slug": "dndrv", "id": "4e7563f0-0d77-43e9-b765-a509ba121818", "names": [ "DNDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Oracle Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dndrv" }, { "slug": "dpmemio", "id": "741677e9-20d5-40e5-9cd2-3bf2beb76322", "names": [ "dpmemio.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-06", "companies": [ "Windows (R) Codename Longhorn DDK provider" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/288", "https://www.virustotal.com/gui/file/7cf6881e43337c288b1883fafb234146a450ff94388aee395e05e36202c5afbb", "https://www.virustotal.com/gui/file/cd631c54fe1375e4bdd2f63b58bd106066eeee267fc77b3161ceb023ab5fddda" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dpmemio" }, { "slug": "driver-090d409f", "id": "00561455-9da1-4f0c-8564-e4c99b716a74", "names": [ "driver_090d409f.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Pinchins Technology Co.,Ltd." ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-090d409f" }, { "slug": "driver-099ef491", "id": "2ba1bccf-d8d7-464a-9ae1-41371c55e5e8", "names": [ "driver_099ef491.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-099ef491" }, { "slug": "driver-0a636606", "id": "82087b26-b649-4ad1-a353-3a225c757ff7", "names": [ "driver_0a636606.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-0a636606" }, { "slug": "driver-0ffb4081", "id": "8081b0d0-e18e-474a-bdfa-8ff1956d90cb", "names": [ "driver_0ffb4081.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-0ffb4081" }, { "slug": "driver-146b8f4f", "id": "cea8bd08-a3c5-4ae1-a568-387b909ada67", "names": [ "driver_146b8f4f.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Pinchins Technology Co.,Ltd." ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-146b8f4f" }, { "slug": "driver-16773074", "id": "a0f0d0db-15a2-48e4-af39-50967ee8b541", "names": [ "driver_16773074.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-16773074" }, { "slug": "driver-1a74c2bd", "id": "af153e7c-13fa-4a40-a095-00726ad6d783", "names": [ "driver_1a74c2bd.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Pinchins Technology Co.,Ltd." ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-1a74c2bd" }, { "slug": "driver-1afc1d06", "id": "d7773616-9860-4768-b6a2-d74f32c23b4e", "names": [ "driver_1afc1d06.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-1afc1d06" }, { "slug": "driver-206006a1", "id": "9e0a1bae-6509-41fd-a5bf-dfe6cf388682", "names": [ "driver_206006a1.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-206006a1" }, { "slug": "driver-290bc782", "id": "f5c1a46f-21e6-4b06-b212-2dc55b699497", "names": [ "driver_290bc782.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Microsoft Corporation" ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-290bc782" }, { "slug": "driver-312c83a9", "id": "495f0f36-c5e0-467d-8115-b5bdbe7ff686", "names": [ "driver_312c83a9.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-312c83a9" }, { "slug": "driver-4d8bc539", "id": "e7fd8ffc-ab37-4a7b-8dc9-fc7432fbacae", "names": [ "driver_4d8bc539.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-4d8bc539" }, { "slug": "driver-4f9b5a2f", "id": "b660d253-2b60-46c5-b95a-c354aa5eb154", "names": [ "driver_4f9b5a2f.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-4f9b5a2f" }, { "slug": "driver-4fc254af", "id": "85335187-dae0-4f06-acea-209efaf74973", "names": [ "driver_4fc254af.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-4fc254af" }, { "slug": "driver-5c308aed", "id": "647f72e7-f378-4908-946c-5e45fab448e8", "names": [ "driver_5c308aed.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-5c308aed" }, { "slug": "driver-5d61e4ea", "id": "0215d6d6-e0c4-4a11-bd3a-40511f89d736", "names": [ "driver_5d61e4ea.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-5d61e4ea" }, { "slug": "driver-668c5bea", "id": "04eefdf4-448d-45bb-87fc-93f263fc77f4", "names": [ "driver_668c5bea.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-668c5bea" }, { "slug": "driver-77225a99", "id": "5fb86651-c152-404a-9a2f-0f54b0d2bb55", "names": [ "driver_77225a99.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Tonec Inc." ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-77225a99" }, { "slug": "driver-82d928c5", "id": "af8ef3c0-8686-4112-992b-86587a4a9060", "names": [ "driver_82d928c5.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-82d928c5" }, { "slug": "driver-85ca0dcd", "id": "e1c29414-5b5b-44f4-84cc-e6f55d9a23c6", "names": [ "driver_85ca0dcd.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-85ca0dcd" }, { "slug": "driver-89036534", "id": "750a8aa9-a87c-4142-b96b-18ea139ada14", "names": [ "driver_89036534.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-89036534" }, { "slug": "driver-930da474", "id": "4c4e7664-af86-4483-858a-f59346f3d304", "names": [ "driver_930da474.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Pinchins Technology Co.,Ltd." ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-930da474" }, { "slug": "driver-981d03e1", "id": "1106fe7a-b78b-4edf-85c0-6208979f380b", "names": [ "driver_981d03e1.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-981d03e1" }, { "slug": "driver-a6deeea6", "id": "f694c0e1-b75d-4c41-acbd-a87b72d8abe4", "names": [ "driver_a6deeea6.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-a6deeea6" }, { "slug": "driver-ab811ca5", "id": "09d2e61d-e041-4ec8-ab7b-385848456a36", "names": [ "driver_ab811ca5.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-ab811ca5" }, { "slug": "driver-b4f33ffe", "id": "51a44484-8bcc-4150-8b94-4a755cff0af8", "names": [ "driver_b4f33ffe.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Chingachguk & Denger2k" ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-b4f33ffe" }, { "slug": "driver-bfcbc010", "id": "dbfcce10-76a3-44a4-a9b8-d7126152a235", "names": [ "driver_bfcbc010.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-bfcbc010" }, { "slug": "driver-c3d48ddd", "id": "f6c08b8a-1d25-4bf1-9d4f-5368c1f6cfe7", "names": [ "driver_c3d48ddd.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-c3d48ddd" }, { "slug": "driver-d1ea9e16", "id": "8697785a-d088-42a7-ac25-b5c8a3b22664", "names": [ "driver_d1ea9e16.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-d1ea9e16" }, { "slug": "driver-d9f15d91", "id": "576bb95a-f15e-4a0d-bcee-08791e1504e2", "names": [ "driver_d9f15d91.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-d9f15d91" }, { "slug": "driver-e1123b59", "id": "11a73c42-26aa-446b-8560-43eecb265091", "names": [ "driver_e1123b59.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "湖北盾网网络科技有限公司" ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-e1123b59" }, { "slug": "driver-ef9d653a", "id": "14e51012-5429-483e-9423-49778c3bd1c2", "names": [ "driver_ef9d653a.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-ef9d653a" }, { "slug": "driver-fdd16a94", "id": "da066835-f37c-40bf-86bb-d77ad45c7f30", "names": [ "driver_fdd16a94.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-fdd16a94" }, { "slug": "driver-win10", "id": "cb9f4425-66de-4371-a3df-3aeec1fda65c", "names": [ "Driver_win10.sys", "Filter.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-05-05", "companies": [], "resources": [ "https://www.virustotal.com/gui/file/70c9f9e8dcbba700e0fc20e6ae9b4c5df98326cf212ac8794fc8ee9a46e948c4", "https://www.virustotal.com/gui/file/c4179ed787aab61dc99879e87e1155003c5438cf683455b1230959f55296579d", "https://www.virustotal.com/gui/file/97550af2414d6c9b70d67b2142b6711e98289483cec3f788192096638c2dda51" ], "sampleCount": 3, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver-win10" }, { "slug": "driver7-x64", "id": "48bc2815-85ec-4436-a51a-69810c8cb171", "names": [ "driver7-x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASUStek" ], "resources": [ "https://github.com/Chigusa0w0/AsusDriversPrivEscala" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver7-x64" }, { "slug": "driver7-x86-withoutdbg", "id": "d9f2c3d6-160c-4eb3-8547-894fcf810342", "names": [ "driver7-x86-withoutdbg.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASUStek" ], "resources": [ "https://github.com/Chigusa0w0/AsusDriversPrivEscala" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver7-x86-withoutdbg" }, { "slug": "driver7-x86", "id": "670dc258-78b5-4552-a16b-b41917c86f8d", "names": [ "driver7-x86.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASUStek" ], "resources": [ "https://github.com/Chigusa0w0/AsusDriversPrivEscala" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver7-x86" }, { "slug": "driver7", "id": "9ca73d04-3349-4c16-9384-94c43335a031", "names": [ "Driver7.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "ASUStek" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driver7" }, { "slug": "driverscloud-amd64", "id": "b3f7c8d2-4a19-4e5b-9d6c-2f8e1a3b7c04", "names": [ "DriversCloud_amd64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-06", "companies": [ "CybelSoft" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/284", "https://www.virustotal.com/gui/file/2bc72d11fa0beda25dc1dbc372967db49bd3c3a3903913f0877bff6792724dfe" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#driverscloud-amd64" }, { "slug": "dsark64", "id": "399fb787-5b06-46f0-86cb-dff7374bb015", "names": [ "DsArk64.sys", "DsArk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-13", "companies": [ "360.cn" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/308", "https://huorong.cn/document/info/classroom/2040" ], "sampleCount": 4, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dsark64" }, { "slug": "dtr-ec", "id": "a2177b22-0401-4c31-8ae4-40a7e2a53653", "names": [ "dtr_ec.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-13", "companies": [ "Dell Technologies" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/293" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dtr-ec" }, { "slug": "dxiw8ez9ayxqyzgm", "id": "847e6aa7-ce2d-4f4a-aa6c-a00c5f0ad728", "names": [ "dXIw8eZ9aYxQYzgm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#dxiw8ez9ayxqyzgm" }, { "slug": "e29f6311ae87542b3d693c1f38e4e3ad", "id": "c00f818c-1c90-4b47-bc29-fb949f6efb65", "names": [ "e29f6311ae87542b3d693c1f38e4e3ad.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#e29f6311ae87542b3d693c1f38e4e3ad" }, { "slug": "e939448b28a4edc81f1f974cebf6e7d2", "id": "4f2edf45-b135-404f-bedc-9583f0bae574", "names": [ "e939448b28a4edc81f1f974cebf6e7d2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#e939448b28a4edc81f1f974cebf6e7d2" }, { "slug": "echo-driver", "id": "afb8bb46-1d13-407d-9866-1daa7c82ca63", "names": [ "echo_driver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1134", "verified": true, "created": "2023-07-14", "companies": [], "resources": [ "https://ioctl.fail/echo-ac-writeup/", "https://github.com/kite03/echoac-poc/tree/main/PoC", "https://github.com/pseuxide/kur" ], "sampleCount": 5, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#echo-driver" }, { "slug": "ecsiodriverx64", "id": "0f749d4e-145e-4b8e-bea6-47003d228043", "names": [ "ecsiodriverx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Elitegroup Computer Systems" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ecsiodriverx64" }, { "slug": "ef0e1725aaf0c6c972593f860531a2ea", "id": "8c2df58f-1e02-4911-ad40-3fa4ed1f4333", "names": [ "ef0e1725aaf0c6c972593f860531a2ea.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2023-07-31", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ef0e1725aaf0c6c972593f860531a2ea" }, { "slug": "eio", "id": "f654ad84-c61d-477c-a0b2-d153b927dfcc", "names": [ "EIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-20", "companies": [ "ASUSTeK Computer Inc." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#eio" }, { "slug": "elbycdio", "id": "855ade1f-8a9e-4c9d-ab8e-d7e409609852", "names": [ "elbycdio.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2009-0824" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Elaborate Bytes AG", "Elaborate Bytes" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf" ], "sampleCount": 32, "hvciLoadableCount": 7, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#elbycdio" }, { "slug": "elbycdio-9a4dcf", "id": "7a722cd5-69ec-4680-9f20-9387f249a891", "names": [ "ElbyCDIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Elaborate Bytes AG" ], "resources": [ "Internal Research" ], "sampleCount": 10, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#elbycdio-9a4dcf" }, { "slug": "elrawdsk", "id": "205721b7-b83b-414a-b4b5-8bacb4a37777", "names": [ "elrawdsk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "EldoS Corporation" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "https://securelist.com/shamoon-the-wiper-further-details-part-ii/57784/", "https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Shamoon.yar" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#elrawdsk" }, { "slug": "ene", "id": "3bec7340-bd8b-43ae-8569-d81a66f01dda", "names": [ "ene.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ene" }, { "slug": "eneio64", "id": "90ecbbf7-b02f-424d-8b7d-56cc9e3b5873", "names": [ "eneio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#eneio64" }, { "slug": "eneio64-6f7209", "id": "9b65dba4-81a0-48cc-8ff0-a4f353881062", "names": [ "EneIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#eneio64-6f7209" }, { "slug": "energydriver", "id": "3dc0b91e-6afe-4938-ad9a-2cdf10c2c1e6", "names": [ "energydriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/issues/329", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#energydriver" }, { "slug": "enetechio64", "id": "d64167b6-f281-41d8-9535-6cb925e77aec", "names": [ "EneTechIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/hfiref0x/KDU/releases/tag/v1.2.0", "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#enetechio64" }, { "slug": "enportv", "id": "18935808-e00c-4b75-a7fc-03e409a7570e", "names": [ "EnPortv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [ "Guidance Software Inc." ], "resources": [ "https://github.com/KOSEC-LLC/BYOVD-Research/tree/main/EnCase", "https://www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/", "https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#enportv" }, { "slug": "etdsupp", "id": "0e8da43d-92e0-43f9-bc34-50a7d15b34bd", "names": [ "etdsupp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-11", "companies": [ "HP Development Company" ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#etdsupp" }, { "slug": "evga-kernel-driver-x64", "id": "02bbc006-a4a4-438f-9b6c-4382303f6b45", "names": [ "evga_kernel_driver-x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#evga-kernel-driver-x64" }, { "slug": "f", "id": "17a1ad58-ecf3-4dea-b1ca-336880d15256", "names": [ "f.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#f" }, { "slug": "fairplaykd", "id": "31686f0e-3748-48c2-be09-fc8f3252e780", "names": [ "FairplayKD.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Multi Theft Auto" ], "resources": [ "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html", "https://www.unknowncheats.me/forum/anti-cheat-bypass/244386-mta-fairplaykd-driver-reversed-exploited-rpm.html", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fairplaykd" }, { "slug": "fastdumpx64", "id": "619953be-2115-4da2-bb59-603fcf93a3d2", "names": [ "fastdumpx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "CounterTack" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/trinity-lpe", "https://medium.com/@haider303mustafa/fastdump-sys-citmdrv-sys-567f57e9cd20", "https://github.com/magicsword-io/LOLDrivers/issues/394" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fastdumpx64" }, { "slug": "fbiosdrv", "id": "dc82ae79-d3e2-439a-a4c7-ec1f23e1261b", "names": [ "fbiosdrv.sys", "Fujitsu BIOS Driver" ], "category": "vulnerable driver", "cve": [ "CVE-2025-65001" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "FUJITSU CLIENT COMPUTING LIMITED", "FUJITSU LIMITED" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://jvn.jp/en/vu/JVNVU96854657/index.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-65001" ], "sampleCount": 9, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fbiosdrv" }, { "slug": "fd3b7234419fafc9bdd533f48896ed73-b816c5cd", "id": "c7f76931-e24c-4d94-9e1f-5a083da581b4", "names": [ "fd3b7234419fafc9bdd533f48896ed73_b816c5cd.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-25", "companies": [], "resources": [ "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/", "https://github.com/magicsword-io/LOLDrivers/issues/114" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fd3b7234419fafc9bdd533f48896ed73-b816c5cd" }, { "slug": "fdmcjhjyxziti", "id": "f650dfc3-d3a1-4a9a-8b71-c599d1f9579c", "names": [ "FDMCJHJYXZITI.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Advanced Micro Devices" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fdmcjhjyxziti" }, { "slug": "fekern", "id": "8858c9c8-e570-41ed-a5cc-054d9eb51d40", "names": [ "fekern.sys", "FireEye Realtime Driver", "Trellix HX Agent" ], "category": "vulnerable driver", "cve": [ "CVE-2025-14963" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "FireEye, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2025-14963", "https://thrive.trellix.com/s/article/000015100" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fekern" }, { "slug": "fgme", "id": "d3111e83-52eb-4a8c-817d-761ea72d37e2", "names": [ "fgme.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fgme" }, { "slug": "fh-ethercat-dio", "id": "f16f82de-1ad0-47d8-a869-2c10ed25d9f1", "names": [ "FH-EtherCAT_DIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fh-ethercat-dio" }, { "slug": "fiddrv", "id": "75a933b4-82d8-4eb8-8ed5-a0a2178630a3", "names": [ "fiddrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#fiddrv" }, { "slug": "fiddrv64", "id": "64f3d4b0-6d2b-4275-b3d4-15d092af4092", "names": [ "fiddrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#fiddrv64" }, { "slug": "fidpcidrv", "id": "e6338692-90e0-41b1-9481-a47e0df144ad", "names": [ "fidpcidrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#fidpcidrv" }, { "slug": "fidpcidrv64", "id": "a005e057-c84f-47cd-9b4b-5b1e51a06ab4", "names": [ "fidpcidrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#fidpcidrv64" }, { "slug": "fildds", "id": "af98f6e6-f19e-4705-a7b9-e7ee7377447b", "names": [ "fildds.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-06-20", "companies": [ "Filseclab Corporation" ], "resources": [ "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fildds" }, { "slug": "filnk", "id": "ba91bce3-2cf9-4c44-bbd8-1170a44d23db", "names": [ "filnk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-06-20", "companies": [ "Filseclab Corporation" ], "resources": [ "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#filnk" }, { "slug": "filwfp", "id": "9d4358c3-5d6e-48a0-971e-e2ad7724c106", "names": [ "filwfp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-06-20", "companies": [ "Filseclab Corporation" ], "resources": [ "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1444" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#filwfp" }, { "slug": "fjfwupgd", "id": "2e47cd6a-30a2-4790-9f9c-9de7b0d7bf60", "names": [ "fjfwupgd.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "FUJITSU LIMITED" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fjfwupgd" }, { "slug": "foxkedriver64", "id": "7f52f435-d217-4c13-98a4-4fdc6c8516c8", "names": [ "FoxKeDriver64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Foxconn (R) Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/issues/370", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/sliff-driv-exploit", "https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#foxkedriver64" }, { "slug": "fpcie2com", "id": "9543c507-9b10-4de8-89b9-42a4f24c99ec", "names": [ "FPCIE2COM.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Fintek Corp.", "Feature Integration Technology Inc." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html", "https://github.com/TakahiroHaruyama/VDR/blob/main/result_firmware.org", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 6, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fpcie2com" }, { "slug": "full", "id": "ddbd60c3-0611-4a59-894d-aec84203906f", "names": [ "full.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#full" }, { "slug": "fur", "id": "c1265ee4-aed4-4e65-ac54-c64deb5e3b28", "names": [ "fur.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-07", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware, https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#fur" }, { "slug": "gamedriverx64", "id": "271ace20-2f68-4695-9579-0d4de8cb4fe6", "names": [ "GameDriverX64.sys", "KSophon_x64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2025-61155" ], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "GameDriver", "PROXIMA BETE" ], "resources": [ "https://www.security.com/blog-post/dragonforce-msteams-backdoor", "https://github.com/magicsword-io/LOLDrivers/issues/360", "https://github.com/magicsword-io/LOLDrivers/issues/362", "https://github.com/BlackSnufkin/BYOVD/tree/main/GameDriverX64-Killer", "https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor", "https://nvd.nist.gov/vuln/detail/CVE-2025-61155", "https://github.com/pollotherunner/CVE-2025-61155/blob/main/advisory.md", "https://vespalec.com/blog/tower-of-flaws/", "https://github.com/svespalec/TowerOfFlaws" ], "sampleCount": 10, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gamedriverx64" }, { "slug": "gameink", "id": "86b520f6-cc90-4488-b343-168cad88010d", "names": [ "gameink.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gameink" }, { "slug": "gametersafe", "id": "1ab1ec8c-1231-4ba4-8804-4a2cda103bb8", "names": [ "gametersafe.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gametersafe" }, { "slug": "gametersafe-67421b", "id": "067589f2-4f29-4dc4-bd50-a2e2ee57b25f", "names": [ "GameTerSafe.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gametersafe-67421b" }, { "slug": "gdrv", "id": "2bea1bca-753c-4f09-bc9f-566ab0193f4a", "names": [ "gdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows (R) Server 2003 DDK provider", "GIGA-BYTE TECHNOLOGY CO., LTD." ], "resources": [ "https://github.com/hoangprod/DanSpecial", "https://github.com/namazso/physmem_drivers", "https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities", "https://medium.com/@fsx30/weaponizing-vulnerable-driver-for-privilege-escalation-gigabyte-edition-e73ee523598b", "https://github.com/namazso/physmem_drivers", "https://github.com/hmnthabit/CVE-2018-19320-LPE" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gdrv" }, { "slug": "gdrv-c31845", "id": "613b8509-18c0-4720-b489-736776b6713e", "names": [ "gdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "GIGA-BYTE TECHNOLOGY CO., LTD.", "Windows (R) Server 2003 DDK provider", "Windows (R) 2000 DDK provider" ], "resources": [ "Internal Research" ], "sampleCount": 10, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gdrv-c31845" }, { "slug": "gedevdrv", "id": "e769d1f6-8a38-426f-b5e7-447241204ee1", "names": [ "GEDevDrv.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "GE Intelligent Platforms, Inc.", "General Electric Company" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gedevdrv" }, { "slug": "gftkyj64", "id": "0fc0563c-de9f-41d8-806a-748e04d57365", "names": [ "gftkyj64.sys", "deame.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gftkyj64" }, { "slug": "ggprotect64", "id": "13d67487-8c65-47bb-a3d3-d799b5f7533b", "names": [ "GGProtect64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "湖南南澳网络科技有限公司" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/issues/368", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/GGProtect-exploit", "https://medium.com/@haider303mustafa/bypassing-weak-driver-authentication-to-kill-ppl-protected-processes-ggprotect64-sys-analysis-d8f44c5837b4" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ggprotect64" }, { "slug": "gibepext", "id": "1e69f91e-4ec5-4c6a-b4a4-2279808b6545", "names": [ "gibepext.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Group-IB LTD." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gibepext" }, { "slug": "giveio", "id": "50bbae3f-f6d8-4881-8fd7-a70002d52841", "names": [ "giveio.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-29", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/407", "https://www.almico.com/speedfan.php" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#giveio" }, { "slug": "glckio2", "id": "52ded752-2708-499e-8f37-98e4a9adc23c", "names": [ "GLCKIO2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#glckio2" }, { "slug": "glckio2-4729ff", "id": "868c6920-f6cb-4088-8277-095a1358abe1", "names": [ "GLCKIO2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#glckio2-4729ff" }, { "slug": "globalvistaventures-v3", "id": "90df671c-a903-49bd-ac62-c124d4f6901d", "names": [ "GlobalVistaVentures_v3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#globalvistaventures-v3" }, { "slug": "gmer64", "id": "7ce8fb06-46eb-4f4f-90d5-5518a6561f15", "names": [ "gmer64.sys", "superman.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-22", "companies": [ "GMER" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951", "http://www.gmer.net/", "https://github.com/gtworek/PSBits/blob/master/Misc/KillWithLolDriver.ps1", "https://github.com/ZeroMemoryEx/Blackout", "https://github.com/b1-team/superman" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gmer64" }, { "slug": "goad", "id": "29cb263b-b0b0-40d5-a97d-5ddf4ba79c1e", "names": [ "goad.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#goad" }, { "slug": "gofly64", "id": "c2ed6a76-95ad-45fd-97d4-b55deefb3e32", "names": [ "GoFly64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-22", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/299" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gofly64" }, { "slug": "gpcidrv64", "id": "6736cbe7-33ea-4488-b464-231c0b8d1049", "names": [ "gpcidrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1542", "verified": true, "created": "2023-10-12", "companies": [], "resources": [ "https://github.com/ucsb-seclab/popkorn-artifact/tree/main/evaluation" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gpcidrv64" }, { "slug": "gpu-z", "id": "0d6f1b0f-b94d-4254-b3bb-49de61246260", "names": [ "GPU-Z.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-06-20", "companies": [], "resources": [ "https://github.com/myzxcg/RealBlindingEDR/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gpu-z" }, { "slug": "gtckmdfbs", "id": "b0dedc3f-6e4b-497a-aade-390cbf4beebb", "names": [ "GtcKmdfBs.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Getac Technology Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 5, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#gtckmdfbs" }, { "slug": "gvcidrv64", "id": "56cdac8e-d87d-49c8-b281-6e096c2390d1", "names": [ "gvcidrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gvcidrv64" }, { "slug": "gvcidrv64-d7352b", "id": "7c83cb1a-a5ab-4ea0-aa69-0e9a1d09a82f", "names": [ "GVCIDrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#gvcidrv64-d7352b" }, { "slug": "hardwaremon-x86", "id": "24d8bef2-379c-4a27-bd2d-4f13136f3476", "names": [ "HardwareMon-x86.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Hubei Century Network Technology Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hardwaremon-x86" }, { "slug": "hax", "id": "9771266b-72e2-4ed3-ac14-1ac25dc5fb25", "names": [ "hax.sys", "IntelHaxm.sys", "Intel HAXM", "Hardware Accelerated Execution Manager" ], "category": "vulnerable driver", "cve": [ "CVE-2022-21812" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "Intel Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00655.html", "https://nvd.nist.gov/vuln/detail/CVE-2022-21812" ], "sampleCount": 9, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hax" }, { "slug": "hlpdrv", "id": "73bd234a-6c4f-4304-9e7d-5bc7a3f263e2", "names": [ "hlpdrv.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-10-27", "companies": [], "resources": [ "https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/", "https://github.com/magicsword-io/LOLDrivers/raw/main/drivers/cf7cad39407d8cd93135be42b6bd258f.bin" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hlpdrv" }, { "slug": "hostnt", "id": "e42cd285-4dda-4086-a696-93ab1d6f17ca", "names": [ "HOSTNT.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "SafeNet, Inc." ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hostnt" }, { "slug": "hp-swtools-driver", "id": "19f13965-7078-4c19-a2e3-71ab8b77a9b7", "names": [ "HP_SWTOOLS_DRIVER.sys", "HP_WKS_SWTOOLS_DRIVER.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-29", "companies": [ "HP Inc." ], "resources": [ "https://github.com/10fax01/HP_SWTOOLS_DRIVER", "https://github.com/magicsword-io/LOLDrivers/issues/401" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hp-swtools-driver" }, { "slug": "hp64vision", "id": "da6709ab-3b7a-445d-9a47-e8b4141d4133", "names": [ "hp64vision.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Windows (R) Codename Longhorn DDK provider" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hp64vision" }, { "slug": "hpportiox64", "id": "080ff223-f8e0-49c0-a7b5-e97349cf81a0", "names": [ "HpPortIox64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "HP Inc." ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#hpportiox64" }, { "slug": "hpportiox64-b1768e", "id": "13637210-2e1c-45a4-9f76-fe38c3c34264", "names": [ "HpPortIox64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "HP Inc." ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#hpportiox64-b1768e" }, { "slug": "hw", "id": "5076e737-6744-4266-bef7-bceda65050d6", "names": [ "hw.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "Marvin Test Solutions, Inc." ], "resources": [ "https://northwave-cybersecurity.com/vulnerability-notice-hardware-access-driver-marvintest-solutions?hsLang=en" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hw" }, { "slug": "hw-c42b46", "id": "5969b6dc-b136-480e-a527-3cb2ea2f0da9", "names": [ "hw.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Marvin Test Solutions, Inc." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules", "https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/", "https://www.virustotal.com/gui/file/6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5/detection" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hw-c42b46" }, { "slug": "hw-631e92", "id": "2d7c96d3-2d6c-44cd-a8a1-5239f571a24a", "names": [ "HW.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Marvin Test Solutions, Inc." ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hw-631e92" }, { "slug": "hwauidoos2ec", "id": "2c7d54ff-7b49-4da8-ae77-00ac6fa2944f", "names": [ "HWAuidoOs2Ec.sys", "havoc.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Huawei Device Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor", "https://www.huntress.com/blog/w2-malvertising-to-kernel-mode-edr-kill", "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/", "https://github.com/magicsword-io/LOLDrivers/issues/377" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwauidoos2ec" }, { "slug": "hwdetectng", "id": "f92f4c60-b39c-4726-ba74-dcab7f653ae2", "names": [ "hwdetectng.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "iNFERRE" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwdetectng" }, { "slug": "hwinfo32", "id": "2225128d-a23f-434a-aaee-69a88ea64fbd", "names": [ "HWiNFO32.SYS" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "REALiX(tm)" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 11, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwinfo32" }, { "slug": "hwinfo64i", "id": "080a834f-3e19-4cae-b940-a4ecf901db28", "names": [ "HWiNFO64I.SYS" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "REALiX(tm)" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwinfo64i" }, { "slug": "hwos2ec10x64", "id": "3ab0d182-6365-47a7-89f4-34121e889503", "names": [ "HwOs2Ec10x64.sys", "HwOs2Ec.sys", "Huawei MateBook" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Huawei", "Huawei Device Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md", "https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwos2ec10x64" }, { "slug": "hwos2ec7x64", "id": "e4098d7e-78b3-4da1-96cb-68b27f245e02", "names": [ "HwOs2Ec7x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Huawei" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwos2ec7x64" }, { "slug": "hwrwdrv", "id": "e4609b54-cb25-4433-a75a-7a17f43cec00", "names": [ "HwRwDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows® winows 7 driver kits provider" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwrwdrv" }, { "slug": "hwrwdrv-9cfbfd", "id": "81211b5b-36a7-41d6-a6e3-8e43cf7d0405", "names": [ "HwRwDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-20", "companies": [ "Windows® winows 7 driver kits provider" ], "resources": [ "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#hwrwdrv-9cfbfd" }, { "slug": "idmtdi", "id": "c2e98102-2055-48f0-9449-3e7a7f2c0ffe", "names": [ "idmtdi.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-08-28", "companies": [ "Tonec Inc.", "CrowdStrike, Inc.", "Palo Alto Networks, Inc." ], "resources": [ "https://news.sophos.com/en-us/2024/08/27/burnt-cigar-2/" ], "sampleCount": 9, "hvciLoadableCount": 9, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#idmtdi" }, { "slug": "imfforcedelete", "id": "6ca608ec-df2e-4a8d-8a0b-350f9e0271ab", "names": [ "IMFForceDelete", "IMFForceDelete.sys", "ForceDelete.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2019-6494" ], "mitreId": "T1562.001", "verified": true, "created": "2026-06-22", "companies": [ "IObit" ], "resources": [ "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/", "https://www.eset.com/us/about/newsroom/research/eset-research-gentlemen-ransomware-gang-edr-killers/", "https://github.com/magicsword-io/LOLDrivers/issues/377", "https://nvd.nist.gov/vuln/detail/CVE-2019-6494", "https://github.com/advisories/GHSA-rj7p-8gjh-5gqf" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#imfforcedelete" }, { "slug": "immunetutildriver", "id": "79e1e3d4-36d0-4325-8d9c-c6e69b6084da", "names": [ "ImmunetUtilDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Cisco Systems, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#immunetutildriver" }, { "slug": "inetcache", "id": "45b0de20-b3cc-4604-a428-175ea092cd39", "names": [ "inetcache.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#inetcache" }, { "slug": "inpout32", "id": "97fa88f6-3819-4d56-a82c-52a492a9e2b5", "names": [ "inpout32.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Highresolution Enterprises [www.highrez.co.uk]" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 5, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#inpout32" }, { "slug": "inpoutx64", "id": "91ff1575-9ff2-46fd-8bfe-0bb3e3457b7f", "names": [ "inpoutx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Highresolution Enterprises [www.highrez.co.uk]" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#inpoutx64" }, { "slug": "ioaccess", "id": "c08c03ff-a7b7-4282-a9fc-265ae88dc244", "names": [ "IoAccess.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ioaccess" }, { "slug": "iobios64", "id": "00755879-eeb3-4a70-9df6-c4e8ff561cdc", "names": [ "iobios64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iobios64" }, { "slug": "iobitunlocker", "id": "e368efc7-cf69-47ae-8204-f69dac000b22", "names": [ "iobitunlocker.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "IObit", "IObit Information Technology" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 24, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iobitunlocker" }, { "slug": "iocdrv", "id": "9bf541fb-a68e-41a5-aab2-b939acc22bb1", "names": [ "iOCdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Intel Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iocdrv" }, { "slug": "iomanager", "id": "2ad22816-46de-45b5-999b-864944635e0a", "names": [ "IoManager.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "COMPAL ELECTRONIC INC." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iomanager" }, { "slug": "iomap64", "id": "f4990bdd-8821-4a3c-a11a-4651e645810c", "names": [ "IOMap64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2024-41498" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "ASUSTeK Computer Inc." ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://www.asus.com/content/asus-product-security-advisory/" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iomap64" }, { "slug": "iomem64", "id": "04d377f9-36e0-42a4-8d47-62232163dc68", "names": [ "iomem64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "DT Research, Inc." ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iomem64" }, { "slug": "ipctype", "id": "509edc55-1881-4fac-8640-b9c516396505", "names": [ "ipctype.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Digital Electronics Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/313", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ipctype" }, { "slug": "iqvw64", "id": "4dd3289c-522c-4fce-b48e-5370efc90fa1", "names": [ "iQVW64.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Intel Corporation " ], "resources": [ "Internal Research" ], "sampleCount": 19, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iqvw64" }, { "slug": "iqvw64e", "id": "1d2cdef1-de44-4849-80e5-e2fa288df681", "names": [ "iqvw64e.sys", "iQVW64.SYS", "IQVW32.sys", "NalDrv.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2015-2291" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Intel Corporation " ], "resources": [ "https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/", "https://expel.com/blog/well-that-escalated-quickly-how-a-red-team-went-from-domain-user-to-kernel-memory/", "https://github.com/Exploitables/CVE-2015-2291", "https://github.com/Tare05/Intel-CVE-2015-2291", "https://github.com/TheCruZ/kdmapper", "https://gist.github.com/k4nfr3/af970e7facb09195e56f2112e1c9549c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iqvw64e" }, { "slug": "irec", "id": "d74fdf19-b4b0-4ec2-9c29-4213b064138b", "names": [ "irec.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-11", "companies": [], "resources": [ "https://blog.dru1d.ninja/windows-driver-exploit-development-irec-sys-a5eb45093945", "https://gist.github.com/dru1d-foofus/1af21179f253879f101c3a8d4f718bf0", "https://www.binalyze.com/irec" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#irec" }, { "slug": "iscflashx64", "id": "97ed6c7b-be4c-4f60-9157-c788a555ca9f", "names": [ "iscflashx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1542", "verified": true, "created": "2023-10-12", "companies": [ "Insyde Software" ], "resources": [ "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iscflashx64" }, { "slug": "isodrivep64", "id": "0144dbef-1da8-406c-8e35-7afee57dc471", "names": [ "isodrivep64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-26", "companies": [ "CrowdStrike, Inc." ], "resources": [ "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#isodrivep64" }, { "slug": "isodrivep64-a706e0", "id": "bd6490c2-20ea-441e-803c-bc3b957dae4c", "names": [ "isodrivep64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-26", "companies": [], "resources": [ "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#isodrivep64-a706e0" }, { "slug": "iuforcedelete", "id": "b898cc81-1736-45c7-ab41-c104ab17f05d", "names": [ "IUForceDelete.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "IObit" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#iuforcedelete" }, { "slug": "jnprva", "id": "c44e6197-efab-49d2-8a5f-04ae4a0f0ea0", "names": [ "jnprva.sys", "neofltr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "Pulse Secure, LLC" ], "resources": [ "https://northwave-cybersecurity.com/ivanti-pulse-vpn-privilege-escalation" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#jnprva" }, { "slug": "jokercontroller", "id": "4c815256-2534-4476-b15d-7cbf24c80098", "names": [ "jokercontroller.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#jokercontroller" }, { "slug": "k7rkscan", "id": "bd580aba-a804-4afc-adb3-b8ce342c78f6", "names": [ "K7RKScan.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-09-18", "companies": [ "K7 Computing Pvt. Ltd." ], "resources": [ "https://github.com/BlackSnufkin/BYOVD" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#k7rkscan" }, { "slug": "k7rkscan-981759", "id": "9f88300d-e607-4e50-8626-fd799439e049", "names": [ "K7RKScan.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-09-18", "companies": [ "K7 Computing Pvt. Ltd." ], "resources": [ "https://github.com/BlackSnufkin/BYOVD" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#k7rkscan-981759" }, { "slug": "kapchelper-x64", "id": "5261cacf-380c-4573-85ff-a643cbdf009a", "names": [ "KApcHelper_x64.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kapchelper-x64" }, { "slug": "kavservice-bin", "id": "77157886-00f9-4f6e-b217-d896813b630f", "names": [ "kavservice.bin" ], "category": "malicious", "cve": [], "mitreId": "T1562", "verified": true, "created": "2024-01-24", "companies": [], "resources": [ "Internal Research", "https://www.52pojie.cn/thread-1823439-1-1.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kavservice-bin" }, { "slug": "kbdcap64", "id": "6a7d882b-3d9d-4334-be5f-2e29c6bf9ff8", "names": [ "kbdcap64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#kbdcap64" }, { "slug": "kdhacker64-ev", "id": "a6dd3aef-d3a7-4c72-abcd-e633e0c0706c", "names": [ "kdhacker64_ev.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-13", "companies": [ "Kingsoft Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/309" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kdhacker64-ev" }, { "slug": "kdriver", "id": "51808fa6-89a4-4f4d-aabc-0a7b0e99e34d", "names": [ "kdriver.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kdriver" }, { "slug": "kernel-utility-driver64", "id": "c7f94129-f95f-4848-b1ab-68aae24275e7", "names": [ "kernel_utility_driver64.sys", "kernel_utility_driver32.sys" ], "category": "malicious", "cve": [ "" ], "mitreId": "T1562.001", "verified": true, "created": "2026-08-28", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/398", "https://bbs.huorong.cn/thread-163244-1-1.html", "https://github.com/wwwab123/Tjbxld_Drv_CreateProcessCallbacksKiller_BYOVD" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kernel-utility-driver64" }, { "slug": "kerneld-amd64", "id": "3aa6e630-59be-4a15-a30c-aaed4c1edaf0", "names": [ "kerneld.amd64" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 36, "hvciLoadableCount": 8, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kerneld-amd64" }, { "slug": "kevp64", "id": "fe2f68e1-e459-4802-9a9a-23bb3c2fd331", "names": [ "kEvP64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "PowerTool" ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kevp64" }, { "slug": "kevp64-b57621", "id": "73196456-40ae-4b6d-8562-07cf99458a7d", "names": [ "kEvP64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "PowerTool" ], "resources": [ "Internal Research" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kevp64-b57621" }, { "slug": "kexplore", "id": "1b916d35-f62b-41ef-8454-3aed20299cb0", "names": [ "KExplore.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [], "resources": [ "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md", "https://github.com/hsheric0210/SharpKernel/blob/main/provider-list.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kexplore" }, { "slug": "kfeco10x64", "id": "3e0bf6dc-791b-4170-8c40-427e7299d93d", "names": [ "KfeCo10X64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-12", "companies": [ "Rivet Networks, LLC." ], "resources": [ "https://zwclose.github.io/2023/04/18/killer2.html", "https://twitter.com/zwclose/status/1648441215808049153", "https://zwclose.github.io/2022/12/18/killer1.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kfeco10x64" }, { "slug": "kfeco11x64", "id": "76b5dfae-b384-45ce-8646-b2eec6b76a1e", "names": [ "KfeCo11X64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-12", "companies": [ "Rivet Networks, LLC." ], "resources": [ "https://zwclose.github.io/2023/04/18/killer2.html", "https://twitter.com/zwclose/status/1648441215808049153", "https://zwclose.github.io/2022/12/18/killer1.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kfeco11x64" }, { "slug": "khwmon", "id": "b98bc8f5-5dde-417f-a25c-41d95b867d75", "names": [ "Khwmon.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#khwmon" }, { "slug": "kinkajou", "id": "56610446-9914-41f6-a028-33640a683c9d", "names": [ "Kinkajou.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kinkajou" }, { "slug": "kkyum", "id": "459c39a0-d6bd-4d3e-91ae-a701bb0b3198", "names": [ "KKYUM.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-12", "companies": [], "resources": [ "https://github.com/The-Sword-of-Constantine/UsingBYOVD" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kkyum" }, { "slug": "kmwpsms", "id": "a6340f12-b0ee-41c5-acf0-92be886d1296", "names": [ "KmWpsMs.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "NComputing Co., Ltd" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kmwpsms" }, { "slug": "kobjexp", "id": "8347c4af-8946-4135-b890-cde3ed35fc28", "names": [ "KObjExp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [], "resources": [ "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md", "https://github.com/hsheric0210/SharpKernel/blob/main/provider-list.md", "https://github.com/zodiacon/JobExplorer" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kobjexp" }, { "slug": "kprocesshacker", "id": "edd29861-6984-4dbe-8e7c-22e9b6cf68d0", "names": [ "kprocesshacker.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "wj32" ], "resources": [ "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html", "https://www.unknowncheats.me/forum/anti-cheat-bypass/312791-bypaph-process-hackers-bypass-read-write-process-virtual-memory-kernel-mem.html#post2315763", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kprocesshacker" }, { "slug": "kregexp", "id": "eada0015-c868-463c-91a6-d159ee1110d7", "names": [ "KRegExp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [], "resources": [ "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md", "https://github.com/hsheric0210/SharpKernel/blob/main/provider-list.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kregexp" }, { "slug": "ksapi", "id": "7f80bb6e-bbf6-46dd-b77d-ecef24f1c2cd", "names": [ "ksapi.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-09-18", "companies": [ "Kingsoft Corporation" ], "resources": [ "https://github.com/BlackSnufkin/BYOVD" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ksapi" }, { "slug": "ksapi-00b2b4", "id": "fb36ebc6-fdc5-42eb-929b-a07e00c5b9db", "names": [ "ksapi.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-09-18", "companies": [ "Kingsoft Corporation" ], "resources": [ "https://github.com/BlackSnufkin/BYOVD" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ksapi-00b2b4" }, { "slug": "ksld", "id": "57822c56-6531-4a2e-afbf-96f77dc5fcaf", "names": [ "KslD.sys", "MpKslDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-26", "companies": [ "Microsoft Corporation" ], "resources": [ "https://fndsec.net/2025/04/20/uncovering-a-new-loldriver-kaslr-bypass-with-ksld-sys/", "https://github.com/Pumi96/DefenderDump", "https://github.com/vergamota/KslKatz", "https://github.com/andreisss/KslDump", "https://github.com/carved4/gokatz", "https://github.com/Muz1K1zuM/kslkatz_bof" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ksld" }, { "slug": "kt2", "id": "833fc08f-217d-4d3f-8c8e-782c61120407", "names": [ "kt2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#kt2" }, { "slug": "ktapi", "id": "8a6aebaa-34aa-46e8-a864-4189a55fd17b", "names": [ "ktapi.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-07-10", "companies": [ "Kontron Technology A/S" ], "resources": [ "https://expel.com/blog/not-very-gentlemanly-analyzing-a-zero-day-exploit-used-by-the-gentlemen-ransomware-to-disable-targets-edrs/", "https://github.com/magicsword-io/LOLDrivers/issues/386" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ktapi" }, { "slug": "ktes", "id": "c734bcff-aaaa-4450-a9a9-25ee52aa7ff1", "names": [ "ktes.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ktes" }, { "slug": "ktgn", "id": "3ea63674-2599-43b5-9390-4a929ec99f48", "names": [ "ktgn.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ktgn" }, { "slug": "ktmutil7odm", "id": "809e7c77-f0fa-46fb-862c-71969ae0c032", "names": [ "ktmutil7ODM.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-12", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ktmutil7odm" }, { "slug": "l1malwarebits", "id": "ec521bd5-8a3f-46ec-b6d3-414b79977a7e", "names": [ "l1malwarebits.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#l1malwarebits" }, { "slug": "lallamon", "id": "50de2fce-d9b5-4007-abef-22560e4e93b2", "names": [ "Lallamon.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Lallasoft" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lallamon" }, { "slug": "lctka", "id": "d827f7a6-1832-4ddb-90dd-7a8cf1c7f25e", "names": [ "LcTkA.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lctka" }, { "slug": "lecomax64", "id": "47d4b71f-eebd-4775-9e7c-b031135e8f1b", "names": [ "LECOMAx64.sys", "LECOMAx.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "LECO Corporation" ], "resources": [ "https://github.com/redteamfortress/PPLShade#supported-drivers", "https://github.com/magicsword-io/LOLDrivers/issues/354" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lecomax64" }, { "slug": "lenovodiagnosticsdriver", "id": "81a73e57-2e92-4d21-97d3-1c21eb4c3aea", "names": [ "LenovoDiagnosticsDriver.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2022-3699" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Lenovo Group Limited (R)" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules", "https://nephosec.com/cve-2022-3699-lenovo-diagnostics-driver-eop-arbitrary-r-w/", "https://github.com/alfarom256/CVE-2022-3699", "https://support.lenovo.com/us/en/solutions/ps500533-lenovo-diagnostics-vulnerabilities", "https://nvd.nist.gov/vuln/detail/CVE-2022-3699", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lenovodiagnosticsdriver" }, { "slug": "lgcoretemp", "id": "2c3884d3-9e4f-4519-b18b-0969612621bc", "names": [ "LgCoreTemp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-04-15", "companies": [ "Logitech" ], "resources": [ "https://github.com/VoidSec/Exploit-Development/tree/b82b6d3ac1cce66221101d3e0f4634aa64cb4ca7/windows/x64/kernel/logitech_v.9.02.65_DoS" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lgcoretemp" }, { "slug": "lgdatacatcher", "id": "5961e133-ccc3-4530-8f4f-5d975c41028d", "names": [ "LgDataCatcher.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lgdatacatcher" }, { "slug": "lgdcatcher", "id": "a8e999ee-746f-4788-9102-c1d3d2914f56", "names": [ "LgDCatcher.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "NetFilterSDK.com" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#lgdcatcher" }, { "slug": "lha", "id": "1c7631f0-f92f-4be5-8ba7-3eefb0601d45", "names": [ "LHA.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "LG Electronics Inc." ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lha" }, { "slug": "lha-a27c6f", "id": "eb07ef7e-0402-48eb-8e06-8fb76eda5b84", "names": [ "LHA.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "LG Electronics Inc." ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lha-a27c6f" }, { "slug": "libnicm", "id": "a0fbd397-64d5-4af2-844b-b096e08a1866", "names": [ "libnicm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Novell, Inc." ], "resources": [ "Internal Research" ], "sampleCount": 5, "hvciLoadableCount": 3, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#libnicm" }, { "slug": "libnicm-3d3cfa", "id": "2b949a0d-939f-456a-a34f-4589d7712227", "names": [ "libnicm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Novell, Inc.", "Micro Focus" ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 19, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#libnicm-3d3cfa" }, { "slug": "lmiinfo", "id": "a02ee964-a21e-4b08-9c98-a730c90bfd53", "names": [ "LMIinfo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-11", "companies": [ "LogMeIn, Inc." ], "resources": [ "Internal Research" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lmiinfo" }, { "slug": "lnvmsrio", "id": "87680018-393b-47b6-8130-6b41bed2bc7c", "names": [ "LnvMSRIO.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2025-8061" ], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "Lenovo" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://github.com/magicsword-io/LOLDrivers/issues/242", "https://github.com/symeonp/Lenovo-CVE-2025-8061", "https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061.html", "https://nvd.nist.gov/vuln/detail/CVE-2025-8061", "https://support.lenovo.com/us/en/product_security/LEN-200860", "https://github.com/segura2010/lenovo-dispatcher-poc", "https://github.com/spawn451/CVE-2025-8061-Exploit" ], "sampleCount": 10, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lnvmsrio" }, { "slug": "lsigetwin-sliffdriver", "id": "430f94b4-69e8-4541-bea7-329be7d283b7", "names": [ "lsigetwin_SliffDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/issues/370", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/sliff-driv-exploit", "https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lsigetwin-sliffdriver" }, { "slug": "lurker", "id": "3fb743b8-d3ed-4873-9c95-e212720dde21", "names": [ "Lurker.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#lurker" }, { "slug": "lv561av", "id": "47a351ee-8abe-40d8-bc2b-557390fa0945", "names": [ "Lv561av.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Logitech Inc." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#lv561av" }, { "slug": "magdrvamd64", "id": "cfd36b2e-cf96-498e-aeb6-ee20e7b33bbb", "names": [ "magdrvamd64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#magdrvamd64" }, { "slug": "malicious", "id": "3e5c0fc4-bfe8-4af2-9613-4f56b0e3c2c8", "names": [ "malicious.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://github.com/zeze-zeze/CYBERSEC2023-BYOVD-Demo" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#malicious" }, { "slug": "mapmom", "id": "cf94939a-703f-46a4-917b-d6af7e0685ef", "names": [ "mapmom.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mapmom" }, { "slug": "memctl", "id": "ae2a6048-3896-4dd8-9eb1-a4a66104b0cf", "names": [ "MemCtl.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "DFI" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#memctl" }, { "slug": "memloadercustomize", "id": "e69e3427-97cd-43bb-aeda-f1fbbeaa75f6", "names": [ "MemLoaderCustomize.sys", "deletekey.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2026-09-08", "companies": [], "resources": [ "https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#memloadercustomize" }, { "slug": "mhyprot2", "id": "57354c82-ff9c-4a54-8377-d195e4ff0a26", "names": [ "Mhyprot2.sys", "mhyprot.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers", "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "https://github.com/elastic/protections-artifacts/blob/932baf346cc8a743f1963ad3d4565b42ed17bebe/yara/rules/Windows_VulnDriver_Mhyprot.yar", "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c", "https://github.com/kagurazakasanae/Mhyprot2DrvControl/tree/main" ], "sampleCount": 10, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mhyprot2" }, { "slug": "mhyprot3", "id": "2aa003cd-5f36-46a6-ae3d-f5afc2c8baa3", "names": [ "mhyprot3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mhyprot3" }, { "slug": "mhyprotect", "id": "7abc873d-9c28-44c2-8f60-701a8e26af29", "names": [ "mhyprotect.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mhyprotect" }, { "slug": "mhyprotnap", "id": "75a66604-f024-4f11-8ba7-fdd64a0df3bf", "names": [ "mhyprotnap.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mhyprotnap" }, { "slug": "mhyprotrpg", "id": "181b89e5-4bdd-4e95-b1bc-a294a4adfb29", "names": [ "mhyprotrpg.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mhyprotrpg" }, { "slug": "mhyprotrpg-deb83c", "id": "ebdde780-e142-44e7-a998-504c516f4695", "names": [ "mhyprotrpg.Sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mhyprotrpg-deb83c" }, { "slug": "mimidrv", "id": "87752fb8-e9f6-4235-91e2-c4343677d817", "names": [ "mimidrv.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-22", "companies": [ "gentilkiwi (Benjamin DELPY)" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951", "https://github.com/hfiref0x/KDU", "https://posts.specterops.io/mimidrv-in-depth-4d273d19e148", "https://github.com/gentilkiwi/mimikatz" ], "sampleCount": 147, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mimidrv" }, { "slug": "mimikatz", "id": "14556074-b235-4378-b356-f58721629d72", "names": [ "mimikatz.sys" ], "category": "malicious", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 12, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mimikatz" }, { "slug": "mjj0ge", "id": "412f4aaf-5525-458c-b87e-311e504b856d", "names": [ "mJj0ge.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-07", "companies": [], "resources": [ "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mjj0ge" }, { "slug": "mlgbbiicaihflrnh", "id": "b074dcb5-b278-4434-bdd9-14a055d724f3", "names": [ "mlgbbiicaihflrnh.sys" ], "category": "malicious", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mlgbbiicaihflrnh" }, { "slug": "mnemosyne", "id": "24cc4f8d-a88d-4b2d-a912-bc773d12a524", "names": [ "Mnemosyne.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mnemosyne" }, { "slug": "monitor-win10-x64", "id": "ca415ed5-b611-4840-bfb2-6e1eacac33d1", "names": [ "Monitor_win10_x64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2018-16712" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "IObit" ], "resources": [ "https://www.unknowncheats.me/forum/anti-cheat-bypass/334557-vulnerable-driver-megathread.html", "https://www.unknowncheats.me/forum/anti-cheat-bypass/244386-mta-fairplaykd-driver-reversed-exploited-rpm.html", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#monitor-win10-x64" }, { "slug": "monprocessex", "id": "c3c083d2-e9bd-4891-8582-46086de2b2b4", "names": [ "MonProcessEX.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-07-08", "companies": [ "Honor Device Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/384" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#monprocessex" }, { "slug": "msio32", "id": "58509acb-50b4-41a0-9de3-76c571a459e3", "names": [ "msio32.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msio32" }, { "slug": "msio32-826068", "id": "4e5064b4-48d3-418c-a7a8-f0dc7ac0a176", "names": [ "MsIo32.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2019-18845" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://www.activecyber.us/activelabs/viper-rgb-driver-local-privilege-escalation-cve-2019-18845", "http://blog.rewolf.pl/blog/?p=1630", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msio32-826068" }, { "slug": "msio64", "id": "6d21df78-d718-44df-b722-99eec654f5b2", "names": [ "MsIo64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2020-17382" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "MICSYS Technology Co., LTd" ], "resources": [ "https://www.matteomalvica.com/blog/2020/09/24/weaponizing-cve-2020-17382/", "https://packetstormsecurity.com/files/159315/MSI-Ambient-Link-Driver-1.0.0.8-Privilege-Escalation.html", "https://www.coresecurity.com/core-labs/advisories/msi-ambient-link-multiple-vulnerabilities", "https://github.com/Exploitables/CVE-2020-17382", "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msio64" }, { "slug": "msio64-a211b7", "id": "214654eb-90c4-48c8-a183-0157e50bf07f", "names": [ "MsIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "MICSYS Technology Co., LTd", "MICSYS" ], "resources": [ "Internal Research" ], "sampleCount": 6, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msio64-a211b7" }, { "slug": "msqpq", "id": "8198f5af-4b40-4800-a22a-4a7cf957ef37", "names": [ "MSqPq.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://www.trendmicro.com/en_us/research/23/e/blackcat-ransomware-deploys-new-signed-kernel-driver.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msqpq" }, { "slug": "msr", "id": "ee6fa2de-d388-416c-862d-24385c152fad", "names": [ "msr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-12-02", "companies": [], "resources": [ "https://twitter.com/wdormann/status/1699878227261411699", "https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msr" }, { "slug": "msrhook", "id": "1a1cf88a-96d0-46cd-a24d-1535e4a5f6e3", "names": [ "msrhook.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#msrhook" }, { "slug": "mst", "id": "0e94f1a2-beab-4adb-9687-eb2719a201c9", "names": [ "mst.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Mellanox Technologies Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mst" }, { "slug": "mtcbsv64", "id": "3bc629e8-7bf8-40c2-965b-87eb155e0065", "names": [ "mtcBSv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "MiTAC Technology Corporation" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mtcbsv64" }, { "slug": "mtxc9cb", "id": "b7bfe661-591a-45be-823d-ac6dae2edeed", "names": [ "mtxC9CB.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mtxc9cb" }, { "slug": "mtxmem", "id": "7c766ce5-fa74-4080-907d-95f2f68d49e7", "names": [ "mtxmem.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Matrox Electronic Systems Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mtxmem" }, { "slug": "my", "id": "b7ec29c6-e151-4a9f-a293-e61f04ee6489", "names": [ "My.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#my" }, { "slug": "mydrivers", "id": "d9e00cc7-a8f4-4390-a6dc-0f5423e97da4", "names": [ "mydrivers.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2023-1676" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "MyDrivers.com" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules", "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2023-1676", "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1676" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#mydrivers" }, { "slug": "myportio-x64", "id": "7d9fee48-82d8-4582-be9a-a46682054e3e", "names": [ "MyPortIO_x64.sys", "MyPortIO_x86.sys", "MyPortIO0" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-22", "companies": [ "Nuvoton Technology Corp." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/380", "https://sploitus.com/exploit?id=7004A1F2-9DB9-5904-9F61-0492A070C636", "https://www.asrock.com/support/index.asp?cat=Utilities", "https://download.asrock.com/Utility/RGB/PolychromeRGB(v2.0.190).zip", "https://download.asrock.com/Utility/RGB/PolychromeRGB(v2.0.217).zip" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#myportio-x64" }, { "slug": "nbiolib-x64", "id": "6fc3034f-8b40-44ef-807a-f61d3ea2dece", "names": [ "NBIOLib_X64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "MSI" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nbiolib-x64" }, { "slug": "nchgbios2x64", "id": "d2806397-9ceb-47c8-b5f3-3aabec182ff5", "names": [ "NCHGBIOS2x64.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "TOSHIBA Corporation" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nchgbios2x64" }, { "slug": "ncpl", "id": "8ff4ab50-05b7-4bfa-b994-1920c4ed4978", "names": [ "ncpl.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2013-3956" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Novell, Inc." ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ncpl" }, { "slug": "ndislan", "id": "ca1e8664-841f-4e4b-9e67-3f515cc249c6", "names": [ "ndislan.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ndislan" }, { "slug": "neacsafe64", "id": "d474d8ad-14d9-4664-addd-86b4a9b7a1a5", "names": [ "NeacSafe64.sys", "OWNeacSafePort" ], "category": "vulnerable driver", "cve": [ "CVE-2025-45737" ], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "网易(杭州)网络有限公司杭州" ], "resources": [ "https://github.com/za233/NeacController", "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#neacsafe64" }, { "slug": "netfilter", "id": "9454a752-233e-4ba2-b585-8da242bf8f31", "names": [ "Netfilter.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 16, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#netfilter" }, { "slug": "netfilter2", "id": "5ad8a3b6-6d20-4c95-8fa7-9a507167ba3c", "names": [ "netfilter2.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "宏图无忧", "Windows (R) Win 7 DDK provider" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 25, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#netfilter2" }, { "slug": "netfilterdrv", "id": "f1dcb0e4-aa53-4e62-ab09-fb7b4a356916", "names": [ "netfilterdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#netfilterdrv" }, { "slug": "netflt", "id": "35a9afeb-18f1-4c02-a3aa-830e300138ae", "names": [ "netflt.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#netflt" }, { "slug": "netflt-d3602f", "id": "30d6c39c-1d93-4101-8dd3-322ff0ab7fb3", "names": [ "NetFlt.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#netflt-d3602f" }, { "slug": "netproxydriver", "id": "c1ece07b-e92a-4050-95ee-90e03aa82120", "names": [ "NetProxyDriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#netproxydriver" }, { "slug": "networklocker-x64", "id": "0e114b5b-7ec1-4fa3-ac93-e505f986547f", "names": [ "NetworkLocker_x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#networklocker-x64" }, { "slug": "ngiodriver", "id": "b8339454-0e84-4a5b-92d0-6a626ced6677", "names": [ "ngiodriver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "AVAST Software" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 12, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ngiodriver" }, { "slug": "ngstar", "id": "5b9a202c-0695-532e-9d92-662cedefee07", "names": [ "NGStar.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-01", "companies": [ "NITGEN&COMPANY Co., Ltd." ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ngstar" }, { "slug": "ni", "id": "4f93e19c-4600-4e2e-943f-a986875fd7d2", "names": [ "ni.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#ni" }, { "slug": "nicm", "id": "86cff0de-2536-4b8d-a846-a7312c569597", "names": [ "nicm.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2013-3956" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Novell, Inc." ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 18, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nicm" }, { "slug": "nicm-c532bf", "id": "0f8e317e-ad2b-4b02-9f96-603bb8d28604", "names": [ "NICM.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Novell, Inc." ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nicm-c532bf" }, { "slug": "nicm-823003", "id": "f4126206-564f-49f5-a942-2138a3131e0e", "names": [ "NICM.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Novell, Inc." ], "resources": [ "Internal Research" ], "sampleCount": 3, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nicm-823003" }, { "slug": "nipalk", "id": "5ff0ca63-fff8-4c2d-ac04-bb09fc84259f", "names": [ "nipalk.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2021-38304" ], "mitreId": "T1068", "verified": true, "created": "2026-04-10", "companies": [ "National Instruments Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/303", "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/improper-input-validation-in-ni-pal.html", "https://nvd.nist.gov/vuln/detail/CVE-2021-38304" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nipalk" }, { "slug": "nlslexicons0024uvn", "id": "18a842be-681a-4f32-97fd-57cb72ff5f3a", "names": [ "NlsLexicons0024UvN.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-12", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nlslexicons0024uvn" }, { "slug": "nodedriver", "id": "7a5fe570-3b35-4fad-b7d6-7518bd5436a0", "names": [ "NodeDriver.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-02", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nodedriver" }, { "slug": "novawave-novabench-novabenchdriverwin10", "id": "c7789f3c-b638-4f66-a890-7605682306e7", "names": [ "Novawave_Novabench_NovabenchDriverWin10.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#novawave-novabench-novabenchdriverwin10" }, { "slug": "npr0", "id": "cf9ed92d-d39b-4562-a256-b36f6560ccfa", "names": [ "NPR0.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "noping.com" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#npr0" }, { "slug": "nqrmq", "id": "61abe019-08cb-48a3-89b2-62810696f277", "names": [ "NQrmq.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nqrmq" }, { "slug": "nscm", "id": "351ff5ca-f07b-4eb6-9300-d5d31514defb", "names": [ "nscm.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2013-3956" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Novell, Inc.", "Micro Focus" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 33, "hvciLoadableCount": 4, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nscm" }, { "slug": "nscm-302374", "id": "90afa27c-0f67-46a6-b4a9-809f55157c71", "names": [ "nscm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Novell, Inc.", "Micro Focus" ], "resources": [ "Internal Research" ], "sampleCount": 6, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nscm-302374" }, { "slug": "nseckrnl", "id": "c1143cd9-a709-4323-9678-2117285d1b47", "names": [ "NSecKrnl.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-09-18", "companies": [ "NSEC Co.,Ltd" ], "resources": [ "https://hexastrike.com/resources/blog/threat-intelligence/valleyrat-exploiting-byovd-to-kill-endpoint-security/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nseckrnl" }, { "slug": "nstr", "id": "90e8600a-9b5c-4153-bb06-1d8fbe0ef232", "names": [ "nstr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nstr" }, { "slug": "nstrwsk", "id": "e9b099f6-8a12-46f0-a540-40e88cf0ce17", "names": [ "nstrwsk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nstrwsk" }, { "slug": "nt2", "id": "cacc48e6-6ed8-431c-abee-88ee6c2dc3c1", "names": [ "nt2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nt2" }, { "slug": "nt3", "id": "d5118882-6cdd-4b06-8bf4-e9818f16137e", "names": [ "nt3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nt3" }, { "slug": "nt4", "id": "1d4f7a3a-786b-4a74-b34f-14d44343de9e", "names": [ "nt4.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nt4" }, { "slug": "nt5", "id": "193df066-c27c-4343-a4eb-ad2ac417a4cc", "names": [ "nt5.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nt5" }, { "slug": "nt6", "id": "e71f0866-e317-44d4-a456-d6f0c555aa73", "names": [ "nt6.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#nt6" }, { "slug": "ntbios-2", "id": "33a9c9ae-5ca3-442d-9f0f-2615637c1c57", "names": [ "ntbios_2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ntbios-2" }, { "slug": "ntbios", "id": "eef1fcf4-8c54-420b-8d38-9c5f95129dcc", "names": [ "ntbios.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ntbios" }, { "slug": "ntiolib-x64", "id": "54d67d79-0268-4c5f-be7e-0f74cd20828a", "names": [ "NTIOLib_X64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "MSI" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ntiolib-x64" }, { "slug": "ntiolib", "id": "7f9842a0-8118-462e-8860-227265ff4379", "names": [ "NTIOLib.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "MSI" ], "resources": [ "Internal Research" ], "sampleCount": 5, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ntiolib" }, { "slug": "ntiolib-8863ac", "id": "a7bba474-815f-49be-bddc-4d76a64c866c", "names": [ "NTIOLib.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "MSI" ], "resources": [ "https://github.com/namazso/physmem_drivers", "https://github.com/Haider303/trinity-lpe", "https://medium.com/@haider303mustafa/fastdump-sys-citmdrv-sys-567f57e9cd20", "https://github.com/magicsword-io/LOLDrivers/issues/394" ], "sampleCount": 42, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ntiolib-8863ac" }, { "slug": "nvaudio", "id": "837ad058-65f4-4b75-8f21-b842e48db8a5", "names": [ "nvaudio.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "NVidia Corp." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nvaudio" }, { "slug": "nvflash", "id": "d55a5955-6220-4f38-ba7d-91339330fe98", "names": [ "nvflash.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "NVIDIA Corporation" ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 8, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nvflash" }, { "slug": "nvflash-01ea49", "id": "2a6a38ca-f2e6-456e-9ccf-db59d8c80c9e", "names": [ "nvflash.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nvflash-01ea49" }, { "slug": "nvflsh32", "id": "c33648d7-6473-4e2b-92f6-93f195bc183f", "names": [ "nvflsh32.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 11, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nvflsh32" }, { "slug": "nvflsh64", "id": "d4664202-d1b9-44d4-97cc-fee2150082db", "names": [ "nvflsh64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 15, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nvflsh64" }, { "slug": "nvoclock", "id": "3d7da79b-fe34-45cd-a0c9-d4432d40611c", "names": [ "nvoclock.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "NVIDIA Corp.", "NVidia Corp." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 25, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nvoclock" }, { "slug": "nxeng", "id": "6f1d7635-0778-4f17-9c97-b80deca32510", "names": [ "nxeng.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Beijing Huorong Network Technology Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#nxeng" }, { "slug": "oatoolx64", "id": "3a56286a-d6e2-4782-bd43-1e04869da8cc", "names": [ "OAToolx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Insyde Software" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#oatoolx64" }, { "slug": "openlibsys", "id": "2e4fedb0-30ed-400d-b4e1-b2b2004c1607", "names": [ "OpenLibSys.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "OpenLibSys.org" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#openlibsys" }, { "slug": "otipcibus", "id": "17cf4fac-88f1-467d-9f62-481d33accc5b", "names": [ "otipcibus.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "OTi" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#otipcibus" }, { "slug": "p2kghmzsary1", "id": "90239ca5-500d-422a-a3e6-6b771b55b3eb", "names": [ "p2KGhmzsARY1.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#p2kghmzsary1" }, { "slug": "panio", "id": "5f70bde4-9f81-44a8-9d3e-c6c7cf65bfae", "names": [ "PanIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#panio" }, { "slug": "paniox64", "id": "93c84c08-4683-493d-abf7-22dc2d1cb567", "names": [ "PanIOx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#paniox64" }, { "slug": "panmonflt", "id": "cfdc5cb4-be5c-4dcc-a883-825fa72115b4", "names": [ "PanMonFlt.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#panmonflt" }, { "slug": "panmonfltx64", "id": "40bfb01b-d251-4c2c-952e-052a89a76f5b", "names": [ "PanMonFltX64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Pan Yazilim Bilisim Teknolojileri Tic. Ltd. Sti." ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#panmonfltx64" }, { "slug": "pcdsrvc-x64", "id": "d4eb6ed4-c23f-45a9-9891-5aa8f218b863", "names": [ "pcdsrvc_x64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2019-12280" ], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "PC-Doctor, Inc." ], "resources": [ "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md", "https://github.com/hsheric0210/SharpKernel/blob/main/provider-list.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pcdsrvc-x64" }, { "slug": "pchunter", "id": "73290fcb-a0d7-481e-81a5-65a9859b50f5", "names": [ "pchunter.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "安芯网盾（北京）科技有限公司" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pchunter" }, { "slug": "pchunter-9e8fc3", "id": "a261cd64-0d04-4bf5-ad73-f3bb96bf83cf", "names": [ "PCHunter.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "一普明为（北京）信息技术有限公司" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pchunter-9e8fc3" }, { "slug": "pciecubed", "id": "a5ebba11-5a31-48d2-9c6d-78bba397edf1", "names": [ "PcieCubed.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [ "Legal Corp." ], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pciecubed" }, { "slug": "pctcore64", "id": "8f2d3be4-3e25-490f-82bc-0aca16aee101", "names": [ "PCTcore64.sys", "PCTCore64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2026-8501" ], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [ "PC Tools" ], "resources": [ "https://github.com/BlackSnufkin/BYOVD/tree/main/PCTcore64-Killer", "https://kb.cert.org/vuls/id/158530" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pctcore64" }, { "slug": "pdfwkrnl", "id": "fded7e63-0470-40fe-97ed-aa83fd027bad", "names": [ "PDFWKRNL.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Advanced Micro Devices, Inc." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 4, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pdfwkrnl" }, { "slug": "pdfwkrnl-2dfba6", "id": "ed27c0b8-6177-4132-a7af-5c15bcb386f3", "names": [ "PDFWKRNL.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-20", "companies": [ "Advanced Micro Devices, Inc." ], "resources": [ "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pdfwkrnl-2dfba6" }, { "slug": "pgpwded", "id": "1a0fab94-f4a7-48c2-a2f4-72d19c382642", "names": [ "PGPwded.sys", "eedDiskEncryptionDriver.sys", "Symantec Encryption Desktop", "Symantec Endpoint Encryption" ], "category": "vulnerable driver", "cve": [ "CVE-2019-9702", "CVE-2019-9703" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "CA, Inc., a Broadcom subsidiary", "Symantec Corporation" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/0/0/symsa1485", "https://nvd.nist.gov/vuln/detail/CVE-2019-9702", "https://nvd.nist.gov/vuln/detail/CVE-2019-9703", "https://github.com/DavidCarliez/CVE-2019-9702_Symantec_Encryption_Desktop_LPE_PoC" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pgpwded" }, { "slug": "pgrhostcontrol", "id": "82eee73e-156e-4344-b975-babbf0bc131f", "names": [ "PGRHostControl.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-06", "companies": [ "Point Grey Research" ], "resources": [ "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pgrhostcontrol" }, { "slug": "phlashnt", "id": "be3e49ea-095e-4fdb-9529-f4c2dbb9a9fc", "names": [ "PhlashNT.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Phoenix Technologies, Ltd." ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#phlashnt" }, { "slug": "phydmaccx64", "id": "96c8fe71-3acc-41bc-9402-ebd69a961d74", "names": [ "phydmaccx64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#phydmaccx64" }, { "slug": "phydmaccx86", "id": "1055625b-3480-48b3-9556-8628a745d8f0", "names": [ "phydmaccx86.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#phydmaccx86" }, { "slug": "phymem-ext64", "id": "2b918b1a-badb-4a85-9214-961607b21219", "names": [ "phymem_ext64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#phymem-ext64" }, { "slug": "phymem64", "id": "47fe1aaf-02cd-4a41-8bf5-0047015a2a6e", "names": [ "phymem64.sys", "phymem.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Super Micro Computer, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#phymem64" }, { "slug": "phymemx64", "id": "268e87ba-ad44-4f3c-986f-26712cac68da", "names": [ "Phymemx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#phymemx64" }, { "slug": "physmem", "id": "f4c22f4d-eff8-40c5-8b31-146abe5f17b7", "names": [ "physmem.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Hilscher Gesellschaft für Systemaoutomation mbH" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "https://github.com/magicsword-io/LOLDrivers/issues/55", "https://github.com/hfiref0x/KDU" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#physmem" }, { "slug": "piddrv", "id": "354a9fcf-acf1-4151-94d2-af88116f605c", "names": [ "piddrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#piddrv" }, { "slug": "piddrv64", "id": "aaa92ef1-5728-4e15-9fca-b054b02f0fb0", "names": [ "piddrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#piddrv64" }, { "slug": "plugplayservice", "id": "03d1a3a2-e76c-4fd5-a134-55ec983fdc4c", "names": [ "PlugPlayService.sys", "neonddu.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2026-09-08", "companies": [], "resources": [ "https://x.com/nextronresearch/status/2097265605183234075", "https://github.com/NextronSystems/iocs/pull/5", "https://github.com/NextronSystems/iocs/blob/e1fb663fa2e0716824a965d6776980cd60b6713b/reports/whql-signed/readme.md", "https://www.nextron-systems.com/2026/03/20/regphantom-backdoor-threat-analysis/" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#plugplayservice" }, { "slug": "pmad", "id": "ec5012bb-789a-436d-be22-b343c331f7c7", "names": [ "PMAD.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Catalyst Enterprises Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pmad" }, { "slug": "pmxdrv64", "id": "95fc9bf0-ec86-44b3-abad-a4c922aa7742", "names": [ "pmxdrv64.sys", "pmxdrv.sys", "PMxDrv" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "Intel Corporation" ], "resources": [ "https://github.com/hfiref0x/KDU/blob/master/Help/providers.md", "https://github.com/GetRektBoy724/vuln-drivers/tree/main/pmxdrv.sys" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pmxdrv64" }, { "slug": "poisonx", "id": "fc3467c3-6109-447d-b438-7a4276c3d8e5", "names": [ "PoisonX.sys", "G11.sys", "PoisonX10.sys", "PoisonX11.sys", "PoisonX12.sys", "PoisonX13.sys", "PoisonX14.sys", "PoisonX15.sys", "PoisonX16.sys", "PoisonX17.sys", "PoisonX18.sys", "PoisonX2.sys", "PoisonX3.sys", "PoisonX4.sys", "PoisonX5.sys", "PoisonX6.sys", "PoisonX7.sys", "PoisonX8.sys", "PoisonX9.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562", "verified": true, "created": "2026-04-10", "companies": [], "resources": [ "https://medium.com/@jehadbudagga/reverse-engineering-a-0day-used-against-crowdstrike-edr-a5ea1fbe3fd4", "https://github.com/j3h4ck/PoisonKiller/", "https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/", "https://github.com/magicsword-io/LOLDrivers/issues/377" ], "sampleCount": 19, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#poisonx" }, { "slug": "poortry", "id": "25d5ebe3-e827-44a4-86fc-898844595c23", "names": [ "POORTRY.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#poortry" }, { "slug": "poortry1", "id": "2740a074-1e06-4f75-9c6a-dc57a3f85189", "names": [ "POORTRY1.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#poortry1" }, { "slug": "poortry2", "id": "618fbf89-f4e3-4b2a-a4b4-cc4bf7c180e0", "names": [ "POORTRY2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#poortry2" }, { "slug": "portwell", "id": "84f92ac1-1e72-420d-9cc0-65c838b90a4d", "names": [ "portwell.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Portwell Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/314", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#portwell" }, { "slug": "ppa-x64", "id": "d6dc9b52-9918-442d-b03a-f1f614aa4cce", "names": [ "ppa_x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/315", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/trinity-2.0-lpe", "https://medium.com/@haider303mustafa/teaccess-sys-adv64drv-sys-phymem-sys-kaslr-bypass-to-system-token-theft-69441310b7f4", "https://github.com/magicsword-io/LOLDrivers/issues/395" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ppa-x64" }, { "slug": "probmon", "id": "3bf3fd5d-dee3-42da-b8be-6a0b8b7bc88c", "names": [ "probmon.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2024-26506" ], "mitreId": "T1562", "verified": true, "created": "2025-01-29", "companies": [ "ITM SYSTEM" ], "resources": [ "Internal Research", "https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#probmon" }, { "slug": "processctr", "id": "5d658b45-81f0-442e-ac43-7c249ce1d54f", "names": [ "ProcessCtr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-09", "companies": [ "EsafeNet" ], "resources": [ "https://github.com/The-Sword-of-Constantine/UsingBYOVD/blob/master/BYOVD/ProcessCtr.cpp", "https://github.com/KOSEC-LLC/BYOVD-Research/tree/main/EsafeNet" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#processctr" }, { "slug": "procexp", "id": "0567c6c4-282f-406f-9369-7f876b899c25", "names": [ "procexp.Sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Sysinternals - www.sysinternals.com" ], "resources": [ "Internal Research", "https://malware.news/t/lazarus-group-attack-case-using-vulnerability-of-certificate-software-commonly-used-by-public-institutions-and-universities/67715", "https://waawaa.github.io/en/Bypass-PPL-Using-Process-Explorer/", "https://github.com/magicsword-io/LOLDrivers/issues/57", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://github.com/Yaxser/Backstab/blob/master/resources/PROCEXP.sys", "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/", "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951" ], "sampleCount": 31, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#procexp" }, { "slug": "procobsrvesx", "id": "8a1a4a5d-3e41-4539-80cd-0cb751f7fab3", "names": [ "ProcObsrvesx.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "MicroWorld Technologies Inc." ], "resources": [ "https://northwave-cybersecurity.com/vulnerability-notice-escan-antivirus" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#procobsrvesx" }, { "slug": "prokiller64", "id": "6fe10a55-7fb8-4a9d-9ebc-1b27b6e5b833", "names": [ "prokiller64.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-07", "companies": [], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware", "https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#prokiller64" }, { "slug": "protects", "id": "99668140-a8f6-48f8-86d1-cf3bf693600c", "names": [ "ProtectS.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#protects" }, { "slug": "proxy32", "id": "0d0d204b-f6ce-4ce4-8d76-1724a1676c3f", "names": [ "Proxy32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#proxy32" }, { "slug": "proxy64", "id": "5d3f0b7d-7413-48e6-8d9c-7fc0bb5a66ee", "names": [ "Proxy64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#proxy64" }, { "slug": "proxydrv", "id": "0e3b0052-18c7-4c8b-a064-a1332df07af2", "names": [ "ProxyDrv.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "雷神（武汉）网络技术有限公司" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#proxydrv" }, { "slug": "pskd64", "id": "7789e9ca-8508-486b-9d77-7497c5c61474", "names": [ "PSKD64.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-29", "companies": [ "APSoft" ], "resources": [ "https://www.tssc.de/site/products/tools/pciscope", "https://www.tssc.de/site/download/prods/pciscope.exe", "https://github.com/magicsword-io/LOLDrivers/issues/408" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pskd64" }, { "slug": "pskmad-64", "id": "c67ad48b-223e-40f8-bfc7-0cb904d0a3d7", "names": [ "pskmad_64.sys", "PSKMAD.sys", "Panda Kernel Memory Access Driver" ], "category": "vulnerable driver", "cve": [ "CVE-2023-6330", "CVE-2023-6331", "CVE-2023-6332" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "Panda Security, S.L." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://www.sophos.com/en-us/blog/multiple-vulnerabilities-discovered-in-widely-used-security-driver", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00001", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00002", "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2024-00003" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pskmad-64" }, { "slug": "psmounterex", "id": "0f64bf7a-2ef2-45ea-af7d-4e7c87d98777", "names": [ "psmounterex.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://northwave-cybersecurity.com/exploiting-enterprise-backup-software-for-privilege-escalation-part-one" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#psmounterex" }, { "slug": "pstrip64", "id": "1db2dd90-5b8e-43c3-a39b-61e0614fb2ab", "names": [ "pstrip64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2026-29923" ], "mitreId": "T1068", "verified": true, "created": "2026-06-25", "companies": [ "EnTech Taiwan" ], "resources": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-29923", "https://github.com/athenasec16/CVE-2026-29923" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pstrip64" }, { "slug": "pxitrig64", "id": "c8619f49-8e23-489b-9878-53d27533da15", "names": [ "pxitrig64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "ADLink" ], "resources": [], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#pxitrig64" }, { "slug": "qiomem", "id": "6eca187c-8fb2-4eae-9c80-fd9ef9d8c91e", "names": [ "QIOMem.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2026-56129" ], "mitreId": "T1068", "verified": true, "created": "2026-07-10", "companies": [ "TOSHIBA" ], "resources": [ "https://github.com/valium007/qiomem", "https://valium007.github.io/posts/toshiba-vuln/", "https://jvn.jp/vu/JVNVU91051826/", "https://www.cve.org/CVERecord?id=CVE-2026-56129", "https://dynabook.com/assistpc/info/2026/20260619_security.htm" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#qiomem" }, { "slug": "qu829", "id": "3599f0ef-67fc-4130-910f-0c482612d16f", "names": [ "qu829.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-05-05", "companies": [], "resources": [ "https://www.virustotal.com/gui/file/46f2c93c279763a818dffbf89c8893ac0718bd3f5d8fbf327887063068a412a5", "https://www.virustotal.com/gui/file/57d7a0e5d53a7403c2ea7ae6f6836f43a9fdebefcc8408d66e7dea02ffc41f94", "https://github.com/elastic/protections-artifacts" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#qu829" }, { "slug": "radhwmgr", "id": "7bb4d807-9a66-48ff-9fb7-82780f3b015e", "names": [ "RadHwMgr.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Radiant Systems, Inc. ", "NCR Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 6, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#radhwmgr" }, { "slug": "realtime-driver", "id": "6882f954-e69b-464a-b7cf-0cda802d3257", "names": [ "Realtime Driver.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Mandiant" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#realtime-driver" }, { "slug": "reddriver", "id": "87593c63-9e3e-4d09-aa47-94bca0783396", "names": [ "reddriver.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-12", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#reddriver" }, { "slug": "rksafe", "id": "5cbb1918-f7ac-4de8-b334-0bb4824a516b", "names": [ "rksafe.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2026-09-08", "companies": [], "resources": [ "https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rksafe" }, { "slug": "rootlaser", "id": "4c9a91ff-9284-49a7-899d-dfe85a112465", "names": [ "RootLaser.sys", "TrueSight.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "Adlice Software" ], "resources": [ "https://github.com/KOSEC-LLC/BYOVD-Research/tree/main/Adlice", "https://github.com/AmeerTheInteger/Windows-kernel-LPE-RootLaser.sys", "https://github.com/magicsword-io/LOLDrivers/issues/410", "https://github.com/magicsword-io/LOLDrivers/issues/411" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rootlaser" }, { "slug": "rspot", "id": "d9a9fd72-e789-4bba-9b96-549b123e5c40", "names": [ "rspot.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-20", "companies": [ "Beijing Rising Network Security Technology Co., Ltd." ], "resources": [ "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rspot" }, { "slug": "rtcore64", "id": "275c80c5-a67c-4536-b29e-4e481242cb01", "names": [ "RTCore64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 33, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtcore64" }, { "slug": "rtcore64-d720ff", "id": "e32bc3da-4db1-4858-a62c-6fbe4db6afbd", "names": [ "RTCore64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://github.com/VoidSec/Exploit-Development/tree/b82b6d3ac1cce66221101d3e0f4634aa64cb4ca7/windows/x64/kernel/RTCore64_MSI_Afterburner_v.4.6.4.16117" ], "sampleCount": 43, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtcore64-d720ff" }, { "slug": "rtcoremini64", "id": "b9e01a11-6395-4837-a202-0c777d717a43", "names": [ "rtcoremini64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtcoremini64" }, { "slug": "rtif", "id": "36227ce7-2bf6-4963-bfae-c399000a1079", "names": [ "rtif.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "TenAsys Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtif" }, { "slug": "rtkio", "id": "8d3f27bd-c3fd-48d0-913a-e2caa6fbd025", "names": [ "rtkio.sys", "rtkio64.sys", "rtkiow8x64.sys", "rtkiow10x64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Realtek ", "Windows (R) Codename Longhorn DDK provider" ], "resources": [ "Internal Research", "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md", "https://github.com/elastic/protections-artifacts/search?q=rtkio" ], "sampleCount": 14, "hvciLoadableCount": 11, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtkio" }, { "slug": "rtkiow8x64", "id": "998ed67c-9c20-46ef-a6ba-abc606b540b9", "names": [ "rtkiow8x64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Realtek " ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtkiow8x64" }, { "slug": "rtport", "id": "8ecc8439-0554-40d0-9130-c02941deadbe", "names": [ "rtport.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Windows (R) 2003 DDK 3790 provider", "Windows (R) 2000 DDK provider", "REALTEK Semiconductor Corp." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 8, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtport" }, { "slug": "rtsper", "id": "32155681-33e8-4d0d-b9f6-c822851e7321", "names": [ "RtsPer.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Realtek Semiconductor Corporation" ], "resources": [ "https://www.linkedin.com/pulse/vulnerabilities-realtek-sd-card-reader-driver-part-1-myngerbayev-czqmf, https://github.com/zwclose/realteksd" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtsper" }, { "slug": "rtstpx", "id": "610617d5-2566-4f55-b636-29a4ea576654", "names": [ "RtsTpx.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Realtek Semiconductor Corp." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtstpx" }, { "slug": "rtsuer", "id": "71d930a7-3465-4d27-90d4-2a1a08bebb92", "names": [ "RtsUer.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Realsil Semiconductor Corporation" ], "resources": [ "https://www.linkedin.com/pulse/vulnerabilities-realtek-sd-card-reader-driver-part-1-myngerbayev-czqmf, https://github.com/zwclose/realteksd" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rtsuer" }, { "slug": "rwdrv", "id": "fbdd993b-47b1-4448-8c41-24c310802398", "names": [ "rwdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "RW-Everything" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/", "http://rweverything.com/" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rwdrv" }, { "slug": "rwdrv-9c0997", "id": "b03798af-d25a-400b-9236-4643a802846f", "names": [ "RwDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "RW-Everything" ], "resources": [ "Internal Research" ], "sampleCount": 7, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rwdrv-9c0997" }, { "slug": "rzdev-00x10", "id": "adf27819-c7a0-4476-8632-5ca759202542", "names": [ "RzDev_00X10.sys" ], "category": "malicious", "cve": [], "mitreId": "T1014", "verified": true, "created": "2026-09-08", "companies": [], "resources": [ "https://github.com/NextronSystems/iocs/blob/89038fb97602153f20dadb9ba7e9fcaeac9af148/reports/whql-signed/readme.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rzdev-00x10" }, { "slug": "rzpnk", "id": "1c6e1d3b-f825-4065-9e0c-83386883e40f", "names": [ "rzpnk.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2017-9769" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Razer, Inc." ], "resources": [ "https://github.com/nomi-sec/PoC-in-GitHub/blob/2a85c15ed806287861a7adec6545c85aec618e3b/2017/CVE-2017-9769.json#L13", "https://www.rapid7.com/db/modules/exploit/windows/local/razer_zwopenprocess/" ], "sampleCount": 22, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#rzpnk" }, { "slug": "sandra", "id": "bc5e020a-ecff-43c8-b57b-ee17b5f65b21", "names": [ "sandra.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "SiSoftware" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 5, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sandra" }, { "slug": "sandra-a5c614", "id": "a7628504-9e35-4e42-91f7-0c0a512549f4", "names": [ "SANDRA.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "SiSoftware" ], "resources": [ "Internal Research" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sandra-a5c614" }, { "slug": "sbiosio64", "id": "cf805b21-4611-4983-a8b6-271373a45057", "names": [ "SBIOSIO64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 4, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sbiosio64" }, { "slug": "sdrv-win-sliff", "id": "f1dd9c41-2608-48e5-bb3e-191d56b34591", "names": [ "sdrv_win_sliff.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sdrv-win-sliff" }, { "slug": "se64a", "id": "d819bee2-3bff-481f-a301-acc3d1f5fe58", "names": [ "Se64a.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "EnTech Taiwan" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#se64a" }, { "slug": "seasunprotect", "id": "3a9ea9a6-e5e3-439a-b892-1f78dd990099", "names": [ "SeasunProtect.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "Chengdu Westhouse Interactive Entertainment Ltd." ], "resources": [], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#seasunprotect" }, { "slug": "segwindrvx64", "id": "a4aa80bc-4ecd-49ab-bc0f-0f49b07fdd7f", "names": [ "segwindrvx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Insyde Software Corp." ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#segwindrvx64" }, { "slug": "semav6msr", "id": "142453a2-a24d-4b35-8922-6d5939f1c0fc", "names": [ "semav6msr.sys", "semav6msr64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md", "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#semav6msr" }, { "slug": "sense5ext", "id": "70acea34-7ed2-42d5-885c-eca3c2de640c", "names": [ "Sense5Ext.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-03-04", "companies": [ "Sense5 CORP" ], "resources": [ "https://www.mandiant.com/resources/blog/hunting-attestation-signed-malware" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sense5ext" }, { "slug": "sepdrv3-1", "id": "942f58d2-1300-4957-98a0-5f8d601bf55b", "names": [ "sepdrv3_1.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sepdrv3-1" }, { "slug": "sfdrvx32", "id": "6c0c60f0-895d-428a-a8ae-e10390bceb12", "names": [ "sfdrvx32.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Almico Software" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sfdrvx32" }, { "slug": "sfdrvx32-b7c616", "id": "2ada18ae-2c52-49b6-b1a0-cf3b267f6dc7", "names": [ "sfdrvx32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Almico Software" ], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sfdrvx32-b7c616" }, { "slug": "sfdrvx64", "id": "5a03dc5a-115d-4d6f-b5b5-685f4c014a69", "names": [ "sfdrvx64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Almico Software" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 3, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sfdrvx64" }, { "slug": "shield", "id": "0e272ccf-81e5-4612-95d2-365e7ded6eac", "names": [ "shield.sys", "shield-async.sys", "shieldwp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "Horizon Datasys, Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/344" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#shield" }, { "slug": "shimano32", "id": "8d23f7e6-341a-431e-9dc1-bc797773d411", "names": [ "shimano32.sys", "shimano64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-20", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/163" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#shimano32" }, { "slug": "signeddrv", "id": "028aecb5-70d0-4423-87d7-f037a11ef1c9", "names": [ "signeddrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/magicsword-io/LOLDrivers/issues/367", "https://github.com/magicsword-io/LOLDrivers/issues/370", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/winnotify-exp", "https://github.com/Haider303/sliff-driv-exploit", "https://medium.com/@haider303mustafa/winnotify-signeddrv-sys-full-local-privilege-escalation-via-arbitrary-kernel-read-write-09e0c1ababf3", "https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#signeddrv" }, { "slug": "sioctl", "id": "47e08b2f-7925-40c5-9bcf-0af348c07d33", "names": [ "SIOCTL.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sioctl" }, { "slug": "sivx64", "id": "31439f28-4616-4ee1-a6b7-1cf742127909", "names": [ "SIVX64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-06", "companies": [ "Ray Hinchliffe" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/287", "https://www.virustotal.com/gui/file/33903e8fa9f0a2acaa4784d645e309b0bd780693824b6c2c5fef257238c77478" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sivx64" }, { "slug": "skill", "id": "724d7989-dfce-4bb2-9beb-dee15df5b790", "names": [ "skill.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#skill" }, { "slug": "smarteio64", "id": "2a7a59c1-35b8-42b6-a560-2fbf4247a584", "names": [ "SMARTEIO64.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "EVGA Technology Inc." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#smarteio64" }, { "slug": "smep-capcom", "id": "19897aed-9be8-4111-a7d8-35618b9d75b3", "names": [ "smep_capcom.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#smep-capcom" }, { "slug": "smep-namco", "id": "cce291c8-4534-4362-af45-5f45cd32bd92", "names": [ "smep_namco.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#smep-namco" }, { "slug": "smserl64", "id": "09c46890-5aa1-4122-962e-7ed94754e710", "names": [ "SmSerl64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-05-28", "companies": [ "Motorola Inc." ], "resources": [ "https://nvd.nist.gov/vuln/detail/CVE-2024-55414", "https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55414/CVE-2024-55414_SmSerl64.sys_README.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#smserl64" }, { "slug": "snxpsamd", "id": "300cdb55-6e01-4365-83e5-5783be2f9262", "names": [ "snxpsamd.sys", "SUNIX Serial Driver" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "SUNIX Co., Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://nvd.nist.gov/vuln/detail/CVE-2024-55412", "https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55412/CVE-2024-55412_snxpsamd.sys_README.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#snxpsamd" }, { "slug": "sonixddrx64", "id": "9720d49d-c20f-479e-9284-2b3ad120fdf8", "names": [ "SONiXDDRx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sonixddrx64" }, { "slug": "sparkio", "id": "2a9193cc-4e7e-4c8d-9cb4-040723e81841", "names": [ "SparkIO.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/322", "https://nvd.nist.gov/vuln/detail/CVE-2022-37415", "https://gist.github.com/alfarom256/220cb75816ca2b5556e7fc8d8d2803a0" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sparkio" }, { "slug": "speedfan", "id": "137daca4-0d7b-48aa-8574-f7eb6ad02526", "names": [ "speedfan.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2007-5633" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows (R) Server 2003 DDK provider" ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#speedfan" }, { "slug": "spf", "id": "56b320b3-5b12-4ec6-81e2-5a16c56c7478", "names": [ "spf.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#spf" }, { "slug": "spwizimgvt", "id": "b759adfa-b353-4ca3-9dfb-8fadf7a437eb", "names": [ "spwizimgVT.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-12", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#spwizimgvt" }, { "slug": "srswdrv", "id": "5c4142a6-b287-4817-864f-152be08f7c48", "names": [ "srswdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Lenovo" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#srswdrv" }, { "slug": "ssport", "id": "c854b612-0b9f-4fc3-a7b8-a93bed7a291e", "names": [ "SSPORT.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-04-15", "companies": [ "Samsung Electronics" ], "resources": [ "https://github.com/VoidSec/Exploit-Development/tree/b82b6d3ac1cce66221101d3e0f4634aa64cb4ca7/windows/x64/kernel/ssport_v1.0" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ssport" }, { "slug": "stdcdrv64", "id": "f33c2e80-7b01-416b-821a-ed06db4b6511", "names": [ "stdcdrv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Intel Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#stdcdrv64" }, { "slug": "stdcdrvws64", "id": "dc3fdbd3-601a-4d2a-bf34-d2e84c6ff1d3", "names": [ "stdcdrvws64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Intel Corp." ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#stdcdrvws64" }, { "slug": "stprocessmonitor", "id": "0712c54c-69fd-41f2-950a-da678ac51246", "names": [ "STProcessMonitor.sys", "ProcessMonitorDriver.sys", "STProcessMonitor_v114.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-03-20", "companies": [ "Safetica Technologies" ], "resources": [ "https://www.cve.org/CVERecord?id=CVE-2025-70795", "https://github.com/magicsword-io/LOLDrivers/issues/268", "https://github.com/KOSEC-LLC/BYOVD-Research/tree/main/Safetica", "https://github.com/BlackSnufkin/BYOVD/tree/main/STProcessMonitor-Killer" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#stprocessmonitor" }, { "slug": "superbmc", "id": "9074a02a-b1ca-4bfb-8918-5b88e91c04a2", "names": [ "superbmc.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Super Micro Computer, Inc." ], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 6, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#superbmc" }, { "slug": "svioctrlx64", "id": "8d2f15a5-e71a-47ba-a391-55d1a1962368", "names": [ "SvIoCtrlx64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "www.seavo.com" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#svioctrlx64" }, { "slug": "sxav64-v1-5-1", "id": "b1f406cd-117a-45bb-97db-3f9ecb44f70d", "names": [ "sxav64-v1.5.1.sys", "sxav.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1562.001", "verified": true, "created": "2026-08-28", "companies": [ "河南寒露电子科技有限公司" ], "resources": [ "https://github.com/wwwab123/Sxav_ZwDeleteFile_BYOVD" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sxav64-v1-5-1" }, { "slug": "sysconp", "id": "62f76f62-ef82-49ea-a26f-36e5727e8d83", "names": [ "sysconp.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sysconp" }, { "slug": "sysdrv3s", "id": "cf49f43c-d7b4-4c1a-a40d-1be36ea64bff", "names": [ "SysDrv3S.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-22", "companies": [ "3S-Smart Software Solutions GmbH" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/55#issuecomment-1537161951" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sysdrv3s" }, { "slug": "sysfile-x64", "id": "1ce0aa79-8719-447c-908b-75547f2ccc98", "names": [ "SysFile_X64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sysfile-x64" }, { "slug": "sysinfo", "id": "84ccb68d-ce34-4aa2-98d5-7f473c2e1b07", "names": [ "SysInfo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sysinfo" }, { "slug": "sysinfodetectorx64", "id": "c4eab0c0-caf2-42b9-84f1-b4690d3db0d4", "names": [ "SysInfoDetectorX64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Database Harbor Software" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sysinfodetectorx64" }, { "slug": "sysinfox64", "id": "1dd9bcd1-0090-4561-bfc4-481c3d139c81", "names": [ "SysInfoX64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#sysinfox64" }, { "slug": "szkg64", "id": "375e8de3-aae4-488d-8273-66744978b45f", "names": [ "szkg64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-01-10", "companies": [ "iS3 Inc." ], "resources": [ "https://www.greyhathacker.net/?p=1025", "https://decoder.cloud/2025/01/09/the-almost-forgotten-vulnerable-driver/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#szkg64" }, { "slug": "t", "id": "65660363-0080-4432-abd9-64368dac0283", "names": [ "t.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#t" }, { "slug": "t3", "id": "31a962ce-43ef-410f-873a-7ccc8f00332b", "names": [ "t3.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#t3" }, { "slug": "t7", "id": "7196366e-04f0-4aaf-9184-ed0a0d21a75f", "names": [ "t7.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#t7" }, { "slug": "t8", "id": "8c2fa9d1-b2b1-4ba1-bad9-60c44c2c20eb", "names": [ "t8.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#t8" }, { "slug": "tboflhelper", "id": "07c57c69-c8d7-40cf-8bcc-612671427044", "names": [ "tboflhelper.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "TeraByte, Inc." ], "resources": [ "https://northwave-cybersecurity.com/vulnerability-notice-terabyte-image-for-windows?hsLang=en" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tboflhelper" }, { "slug": "tbt-force-power-control-access64", "id": "408964b3-1799-425b-92bf-465c72a272d1", "names": [ "TBT_Force_Power_Control_Access64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/316", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/Haider303/trinity-2.0-lpe", "https://medium.com/@haider303mustafa/teaccess-sys-adv64drv-sys-phymem-sys-kaslr-bypass-to-system-token-theft-69441310b7f4", "https://github.com/magicsword-io/LOLDrivers/issues/395" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tbt-force-power-control-access64" }, { "slug": "tcio", "id": "12998ebb-8c74-4e44-89a2-2a71c0f6e92b", "names": [ "TcIo.sys", "TcRouter.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-10", "companies": [ "Beckhoff Automation GmbH", "Beckhoff Automation GmbH & Co. KG" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/296", "https://www.cisa.gov/news-events/ics-advisories/icsa-18-081-02", "https://srcincite.io/advisories/src-2018-0007/", "https://nvd.nist.gov/vuln/detail/CVE-2018-7502" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tcio" }, { "slug": "tdeio64", "id": "4f47c65e-2e73-4855-813a-5a823ae845a8", "names": [ "tdeio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tdeio64" }, { "slug": "tdevflt", "id": "65458077-861e-4423-b446-2a9c7afe44b5", "names": [ "tdevflt.sys", "ABYSSWORKER" ], "category": "malicious", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [ "Palo Alto Networks, Inc." ], "resources": [ "https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor", "https://www.elastic.co/security-labs/abyssworker" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tdevflt" }, { "slug": "tdklib64", "id": "933f5671-e995-4976-8392-52d34dcd4e05", "names": [ "TdkLib64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 17, "hvciLoadableCount": 17, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tdklib64" }, { "slug": "telephonuafy", "id": "0d039ee9-aaa5-49c2-a980-405d4290ee0a", "names": [ "telephonuAfY.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-11", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 5, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#telephonuafy" }, { "slug": "termdd", "id": "ef848b1c-e197-4f98-aa19-4580f41a98b8", "names": [ "termdd.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-11-07", "companies": [ "Microsoft Corporation" ], "resources": [ "Internal Research", "https://kat.lua.cz/posts/Some_fun_with_vintage_bugs_and_driver_signing_enforcement/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#termdd" }, { "slug": "test2", "id": "6356d7d9-3b82-4731-9d5f-cc9bc37558fc", "names": [ "test2.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#test2" }, { "slug": "testbone", "id": "be4843ef-a2a8-4a0d-91c6-42e165800bb0", "names": [ "TestBone.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#testbone" }, { "slug": "tfbfs3ped", "id": "500e07cb-77c6-4e83-ae3f-73f70f1c10b5", "names": [ "tfbfs3ped.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tfbfs3ped" }, { "slug": "tfsysmon", "id": "bd9f084e-b235-4978-bf2a-5f1dc02937df", "names": [ "TfSysMon.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-08-15", "companies": [ "PC Tools", "Advanced Micro Devices, Inc" ], "resources": [ "https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tfsysmon" }, { "slug": "tgsafe", "id": "ad693146-4adf-4407-bb20-f2505e34c226", "names": [ "TGSafe.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#tgsafe" }, { "slug": "thelper", "id": "4c009d0a-8dfa-49f7-b043-b9cef3b01101", "names": [ "thelper.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-03-20", "companies": [ "TEC Solutions Limited." ], "resources": [ "https://www.welivesecurity.com/en/eset-research/edr-killers-explained/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#thelper" }, { "slug": "throttlestop", "id": "6e0786f5-2168-40a8-a068-e261c4eb10e7", "names": [ "throttlestop.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-05-29", "companies": [], "resources": [ "https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/", "https://www.cve.org/CVERecord?id=CVE-2025-7771" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#throttlestop" }, { "slug": "titidrv", "id": "705facba-b595-41dd-86a6-93aefe6a6234", "names": [ "titidrv.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "genitlkiwi (Benjamin XXXXX)" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#titidrv" }, { "slug": "tm-filter", "id": "651d1cdc-3e13-405f-b8b3-65cc70cef5a8", "names": [ "tm_filter.sys", "tmfsdrv2.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1056.001", "verified": true, "created": "2026-03-20", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/243" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tm-filter" }, { "slug": "tmcomm", "id": "22aa985b-5fdb-4e38-9382-a496220c27ec", "names": [ "TmComm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Trend Micro Inc." ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#tmcomm" }, { "slug": "tmcomm-3fdb3e", "id": "d35cb48d-2aca-4d7d-a194-f4566183bcd9", "names": [ "TmComm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Trend Micro Inc." ], "resources": [ "Internal Research" ], "sampleCount": 41, "hvciLoadableCount": 7, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#tmcomm-3fdb3e" }, { "slug": "tmel", "id": "1aeb1205-8b02-42b6-a563-b953ea337c19", "names": [ "Tmel.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "Trend Micro Inc." ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tmel" }, { "slug": "tpwsav", "id": "c0634ed7-840e-4a7e-8b34-33efe50405c2", "names": [ "TPwSav.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-01-31", "companies": [ "Compal Electronic, Inc. " ], "resources": [ "https://blackpointcyber.com/resources/blog/qilin-ransomware-and-the-hidden-dangers-of-byovd/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tpwsav" }, { "slug": "trixx", "id": "f0a02666-44f6-4174-a7c6-d006481a340f", "names": [ "TRIXX.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-07", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/291", "https://github.com/magicsword-io/LOLDrivers/issues/320" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#trixx" }, { "slug": "truesight", "id": "e0e93453-1007-4799-ad02-9b461b7e0398", "names": [ "truesight.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-10", "companies": [ "Adlice Software" ], "resources": [ "https://github.com/ph4nt0mbyt3/Darkside" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#truesight" }, { "slug": "tsdrvx64", "id": "424a387e-735e-49d1-99de-f067dcf1c3e9", "names": [ "TSDRVX64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "ToolHouse Entwicklungs-KG" ], "resources": [ "https://github.com/elastic/protections-artifacts/blob/main/yara/rules/Windows_VulnDriver_Tsdrvx64.yar", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tsdrvx64" }, { "slug": "tvicport64", "id": "b4f3a1c2-e8d7-4f92-a301-5c6d9e0b1a2f", "names": [ "TVicPort64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-PENDING" ], "mitreId": "T1068", "verified": true, "created": "2026-02-13", "companies": [ "EnTech Taiwan" ], "resources": [ "https://www.entechtaiwan.com/dev/port/index.shtm" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#tvicport64" }, { "slug": "typelibde", "id": "9713603a-53bf-4907-a304-b422db741fc6", "names": [ "typelibdE.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-07-12", "companies": [], "resources": [ "https://blog.talosintelligence.com/undocumented-reddriver/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#typelibde" }, { "slug": "ucorew64", "id": "a338a9fc-9fe3-400c-9fe4-69bb7892602d", "names": [ "UCOREW64.SYS" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#ucorew64" }, { "slug": "uddb2b6", "id": "886af494-4087-48c9-b48f-53e638d6f62e", "names": [ "UDDB2B6.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/323", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#uddb2b6" }, { "slug": "unknown", "id": "bffcac17-f20c-43cc-baf0-93fd20bc1ed5", "names": [ "unknown.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [], "resources": [ "https://github.com/BlackSnufkin/BYOVD/tree/main/UnknownKiller", "https://github.com/lukmannurhikma/UnknownKiller" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#unknown" }, { "slug": "vboxdrv", "id": "2da3a276-9e38-4ee6-903d-d15f7c355e7c", "names": [ "vboxdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Sun Microsystems, Inc." ], "resources": [ "https://unit42.paloaltonetworks.com/acidbox-rare-malware/", "https://www.coresecurity.com/core-labs/advisories/virtualbox-privilege-escalation-vulnerability", "https://unit42.paloaltonetworks.com/acidbox-rare-malware/" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxdrv" }, { "slug": "vboxdrv-0700a3", "id": "79542852-3a0c-43bc-bfa3-3eeb0e1d7fd2", "names": [ "VBoxDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Vektor T13 Security Service", "Sun Microsystems, Inc.", "Pinduoduo Ltd Corp" ], "resources": [ "Internal Research" ], "sampleCount": 7, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxdrv-0700a3" }, { "slug": "vboxguest", "id": "0baa833c-e4e1-449e-86ee-cafeb11f5fd5", "names": [ "vboxguest.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "innotek GmbH" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxguest" }, { "slug": "vboxmousent", "id": "ecabc507-2cc7-4011-89ab-7d9d659e6f88", "names": [ "VBoxMouseNT.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "innotek GmbH" ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxmousent" }, { "slug": "vboxtap", "id": "f22e7230-5f32-4c4e-bc9d-9076ebf10baa", "names": [ "VBoxTAP.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "innotek GmbH", "Sun Microsystems, Inc." ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxtap" }, { "slug": "vboxusb", "id": "5938df1d-9513-449f-8252-c442ddca0c2a", "names": [ "VBoxUSB.Sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxusb" }, { "slug": "vboxusb-acc6cd", "id": "70fa8606-c147-4c40-8b7a-980290075327", "names": [ "VBoxUSB.Sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "innotek GmbH", "Sun Microsystems, Inc." ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxusb-acc6cd" }, { "slug": "vboxusbmon", "id": "babe348d-f160-41ec-9db9-2413b989c1f0", "names": [ "VBoxUSBMon.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [ "innotek GmbH", "Sun Microsystems, Inc." ], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vboxusbmon" }, { "slug": "vdbsv64", "id": "5901421f-7929-487d-87bd-632f29290352", "names": [ "VdBSv64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "MiTAC Technology Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vdbsv64" }, { "slug": "viraglt64", "id": "c3cca618-5a7f-4a51-8785-cb328fbfb0df", "names": [ "viraglt64.sys", "viragt64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "TG Soft S.a.s." ], "resources": [ "https://github.com/jbaines-r7/dellicious", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#viraglt64" }, { "slug": "viragt", "id": "39742f99-2180-46d7-8538-56667c935cc3", "names": [ "viragt.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "TG Soft S.a.s." ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#viragt" }, { "slug": "viragt64", "id": "7edb5602-239f-460a-89d6-363ff1059765", "names": [ "viragt64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "TG Soft S.a.s." ], "resources": [ "Internal Research" ], "sampleCount": 8, "hvciLoadableCount": 5, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#viragt64" }, { "slug": "viverraudio", "id": "4cb95b41-43b4-4806-b536-ae5fd8c76b0e", "names": [ "ViveRRAudio.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "HTC VIVE" ], "resources": [ "https://northwave-cybersecurity.com/vive-vr-headset-kernel-driver-vulnerable-for-out-of-bounds-memory-read" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#viverraudio" }, { "slug": "vmdrv", "id": "2ea12acc-95b6-4f91-afb7-8ded7a2fe9d9", "names": [ "vmdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "Internal Research" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vmdrv" }, { "slug": "vmdrv-b2bddf", "id": "fdf4f85b-47f4-4c98-a0d5-a6583463f565", "names": [ "vmdrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vmdrv-b2bddf" }, { "slug": "vproeventmonitor", "id": "4db827b1-325b-444d-9f23-171285a4d12f", "names": [ "VProEventMonitor.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Symantec Corporation" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vproeventmonitor" }, { "slug": "vsdatant", "id": "87d5ec39-482e-4e78-a003-be4b662f85fc", "names": [ "vsdatant.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-03-22", "companies": [ "Check Point, LTD" ], "resources": [ "https://venaksecurity.com/2025/03/20/cybercriminals-exploit-checkpoints-driver-in-a-byovd-attack/" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#vsdatant" }, { "slug": "wamsdk", "id": "9cb4b2fa-67fb-4415-a064-7da7bc47e105", "names": [ "wamsdk.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2025-08-28", "companies": [ "WatchDogDevelopment.com, LLC." ], "resources": [ "https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wamsdk" }, { "slug": "wantd-2", "id": "aa687f89-4f3b-4b59-b64e-fee5e2ae2310", "names": [ "wantd_2.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wantd-2" }, { "slug": "wantd-3", "id": "a22104a8-126d-449f-ba3e-28678c60c587", "names": [ "wantd_3.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wantd-3" }, { "slug": "wantd-4", "id": "72637cb1-5ca2-4ad0-a5df-20da17b231b5", "names": [ "wantd_4.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wantd-4" }, { "slug": "wantd-5", "id": "3277cecc-f4b4-4a00-be01-9da83e013bcd", "names": [ "wantd_5.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wantd-5" }, { "slug": "wantd-6", "id": "127cde1d-905e-4c67-a2c3-04ea4deaea7d", "names": [ "wantd_6.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wantd-6" }, { "slug": "wantd", "id": "892292f9-b87c-40a5-80e5-8c9b02914e8b", "names": [ "wantd.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-02-28", "companies": [ "Microsoft Corporation" ], "resources": [ "https://gist.github.com/MHaggis/9ab3bb795a6018d70fb11fa7c31f8f48", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage", "" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wantd" }, { "slug": "watabe", "id": "549d3563-74ce-4d84-844c-8d985886373c", "names": [ "watabe.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#watabe" }, { "slug": "wcpu", "id": "7f645b95-4374-47ae-be1a-e4415308b550", "names": [ "WCPU.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Windows (R) Codename Longhorn DDK provider" ], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wcpu" }, { "slug": "wdisvhost", "id": "894bd2db-1d93-4b3d-8e4d-7dac29382cb9", "names": [ "wdisvhost.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wdisvhost" }, { "slug": "wdtkernel", "id": "08adabb3-7336-43de-a980-e23a55081f19", "names": [ "WDTKernel.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-07", "companies": [ "Dell Inc" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/290", "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wdtkernel" }, { "slug": "wfshbr64", "id": "ddf661c0-7dfc-4c26-89c5-00cd6a81a139", "names": [ "wfshbr64.sys", "wfshbr32.sys" ], "category": "malicious", "cve": [ "CVE-2022-42046" ], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [], "resources": [ "https://github.com/kkent030315/CVE-2022-42046" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wfshbr64" }, { "slug": "whql", "id": "c366ee89-97ae-4523-b635-e05769384bd3", "names": [ "whql.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#whql" }, { "slug": "wibukey64", "id": "a07e5897-3835-4188-9e3e-bd810c3e34a5", "names": [ "WibuKey64.sys", "WibuKey" ], "category": "vulnerable driver", "cve": [ "CVE-2024-45181", "CVE-2024-45182" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "WIBU-SYSTEMS AG" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-94453.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2024-45181", "https://nvd.nist.gov/vuln/detail/CVE-2024-45182", "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/AdvisoryWIBU-100057.pdf" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wibukey64" }, { "slug": "windbg", "id": "da7314dc-6cf1-4d74-a0d1-796fc08944f8", "names": [ "windbg.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-20", "companies": [ "Microsoft Corporation" ], "resources": [ "https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html" ], "sampleCount": 17, "hvciLoadableCount": 17, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#windbg" }, { "slug": "windbg-dc4f07", "id": "9c3c6e89-3916-498f-81e5-da057ab3ed42", "names": [ "windbg.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-04-22", "companies": [ "Microsoft Corporation" ], "resources": [ "https://www.proofpoint.com/us/blog/threat-insight/now-you-see-it-now-you-dont-copperstealer-performs-widespread-theft", "https://twitter.com/jaydinbas/status/1642898531445886978?s=20", "https://twitter.com/jaydinbas/status/1646475092006785027?s=20" ], "sampleCount": 20, "hvciLoadableCount": 20, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#windbg-dc4f07" }, { "slug": "windivert", "id": "45a31a17-f78d-48ec-beba-74f6bfc5f96e", "names": [ "windivert.sys" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-09-10", "companies": [ "Basil" ], "resources": [ "https://www.3nailsinfosec.com/post/edrprison-borrow-a-legitimate-driver-to-mute-edr-agent", "https://github.com/basil00/WinDivert" ], "sampleCount": 3, "hvciLoadableCount": 3, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#windivert" }, { "slug": "windows-cpu-temperature-component", "id": "52955eb1-8cf4-41f3-b998-5e2e6d3aa258", "names": [ "Windows_CPU_Temperature_Component.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "Guangzhou Shirui Electronics" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers", "https://github.com/fluffycats31/vulnerable-drivers" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#windows-cpu-temperature-component" }, { "slug": "windows-memory-informer", "id": "e354b869-e817-4f9f-8027-a3d5bfb3689b", "names": [ "Windows-Memory-Informer.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/325", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#windows-memory-informer" }, { "slug": "windows-xp-64", "id": "a1d35b93-e97f-4ddd-a465-2405e804e754", "names": [ "windows-xp-64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#windows-xp-64" }, { "slug": "windows7-32", "id": "b45a3fdf-592a-4cd9-81e2-8fe03d554cad", "names": [ "windows7-32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#windows7-32" }, { "slug": "windows8-10-32", "id": "7437388f-821e-421f-a3c1-62ce2c725a6a", "names": [ "windows8-10-32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#windows8-10-32" }, { "slug": "windrvr1251", "id": "d2a619bb-c8c6-4c79-8b6a-8368668bbfb2", "names": [ "windrvr1251.sys", "windrvr1260.sys", "windrvr1280.sys", "windrvr1281.sys", "windrvr1411.sys", "Jungo WinDriver" ], "category": "vulnerable driver", "cve": [ "CVE-2023-47569", "CVE-2023-47570", "CVE-2023-47571", "CVE-2023-47572", "CVE-2024-26314" ], "mitreId": "T1068", "verified": true, "created": "2026-08-31", "companies": [ "Jungo Connectivity" ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/409", "https://github.com/fluffycats31/vulnerable-drivers", "https://windriver.jungo.com/version/version-16-2-0/", "https://nvd.nist.gov/vuln/detail/CVE-2023-47569", "https://nvd.nist.gov/vuln/detail/CVE-2023-47570", "https://nvd.nist.gov/vuln/detail/CVE-2023-47571", "https://nvd.nist.gov/vuln/detail/CVE-2023-47572", "https://nvd.nist.gov/vuln/detail/CVE-2024-26314", "https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04" ], "sampleCount": 7, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#windrvr1251" }, { "slug": "winflash64", "id": "902249eb-87cb-4c01-8da7-17675d743cd7", "names": [ "WinFlash64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#winflash64" }, { "slug": "winflash64-282019", "id": "7b893f79-b5b0-4373-9d29-c53a21fe6fc3", "names": [ "WinFlash64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#winflash64-282019" }, { "slug": "winio32", "id": "0f6c3a28-4d04-474b-a098-37383f984686", "names": [ "WinIO32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio32" }, { "slug": "winio32a", "id": "1068f5cc-65dd-4fd0-b3d8-1d982b37405f", "names": [ "WinIO32A.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio32a" }, { "slug": "winio32b", "id": "45f2c348-bf17-40ab-8306-ef14231cc996", "names": [ "WinIO32B.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio32b" }, { "slug": "winio64", "id": "1ff757df-9a40-4f78-a28a-64830440abf7", "names": [ "winio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-05-06", "companies": [], "resources": [ "Internal Research" ], "sampleCount": 2, "hvciLoadableCount": 2, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio64" }, { "slug": "winio64-10b4e8", "id": "94eb0694-29ba-4f8e-b763-86c6371db6cc", "names": [ "winio64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/elastic/protections-artifacts/search?q=VulnDriver" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio64-10b4e8" }, { "slug": "winio64-253027", "id": "96501e5b-e4f2-41a9-a8ee-d09e36d31a39", "names": [ "WinIo64.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-22", "companies": [], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/222", "https://github.com/hfiref0x/KDU", "https://github.com/fluffycats31/vulnerable-drivers", "https://aka.ms/VulnerableDriverBlockList" ], "sampleCount": 5, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio64-253027" }, { "slug": "winio64a", "id": "2cfede23-67f4-4af7-830f-c95ba30a43ae", "names": [ "WinIo64A.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio64a" }, { "slug": "winio64b", "id": "457f8b21-202a-4a3d-a18d-b4aaded9ef02", "names": [ "WinIo64B.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio64b" }, { "slug": "winio64c", "id": "1ed9d02f-17cf-43dd-9645-a54452468a5e", "names": [ "WinIo64C.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ " https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules", "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winio64c" }, { "slug": "winiodrv", "id": "b745b5da-9cd6-4b3a-badf-fbe487497705", "names": [ "WINIODrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://github.com/namazso/physmem_drivers" ], "sampleCount": 3, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#winiodrv" }, { "slug": "winring0", "id": "7bb5ff05-25f8-410d-ae99-c8e8f082d24f", "names": [ "WinRing0.sys", "WinRing0x64", "OpenHardwareMonitorLib.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "OpenLibSys.org" ], "resources": [ "https://github.com/namazso/physmem_drivers", "https://github.com/eclypsium/Screwed-Drivers/blob/master/DRIVERS.md", "https://github.com/fluffycats31/vulnerable-drivers", "https://aka.ms/VulnerableDriverBlockList" ], "sampleCount": 10, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#winring0" }, { "slug": "wintapix", "id": "93740202-930c-4ab4-8603-8ec9532c5415", "names": [ "WinTapix.sys", "SRVNET2.SYS" ], "category": "malicious", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-06-05", "companies": [ "Microsoft Corporation" ], "resources": [ "https://www.fortinet.com/blog/threat-research/wintapix-kernal-driver-middle-east-countries" ], "sampleCount": 3, "hvciLoadableCount": 3, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wintapix" }, { "slug": "wirwadrv", "id": "a4795ab6-d908-44cf-9ebf-a47db367d385", "names": [ "WiRwaDrv.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-11-02", "companies": [ "Wistron Corporation" ], "resources": [ "https://blogs.vmware.com/security/2023/10/hunting-vulnerable-kernel-drivers.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wirwadrv" }, { "slug": "wiseunlo", "id": "b28cc2ee-d4a2-4fe4-9acb-a7a61cad20c6", "names": [ "WiseUnlo.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "WiseCleaner.com" ], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 7, "hvciLoadableCount": 3, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wiseunlo" }, { "slug": "wnbios", "id": "baa168cd-eba2-42e4-95e9-47cb4b2f9094", "names": [ "wnbios.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2024-06-20", "companies": [ "Windows (R) Win 7 DDK provider" ], "resources": [ "https://github.com/myzxcg/RealBlindingEDR/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wnbios" }, { "slug": "wsdkd", "id": "a8f2da2a-369c-4b4d-9a00-d7a892b9f7c3", "names": [ "wsdkd.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2023-1453" ], "mitreId": "T1068", "verified": true, "created": "2023-09-12", "companies": [ "WatchDogDevelopment.com, LLC." ], "resources": [ "https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-1453", "https://nvd.nist.gov/vuln/detail/CVE-2023-1453", "https://avd.aquasec.com/nvd/2023/cve-2023-1453/" ], "sampleCount": 1, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wsdkd" }, { "slug": "wsftprm", "id": "30e8d598-2c60-49e4-953b-a6f620da1371", "names": [ "wsftprm.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2023-52271" ], "mitreId": "T1068", "verified": true, "created": "2024-09-11", "companies": [ "Topaz OFD" ], "resources": [ "https://northwave-cybersecurity.com/vulnerability-notice-topaz-antifraud", "https://github.com/xM0kht4r/AV-EDR-Killer", "https://github.com/wesmar/kvcKiller", "https://github.com/BlackSnufkin/BYOVD/tree/main/Wsftprm-Killer", "https://www.security.com/threat-intelligence/dragonforce-msteams-backdoor", "https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/" ], "sampleCount": 2, "hvciLoadableCount": 1, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#wsftprm" }, { "slug": "wyproxy64", "id": "f93e88c2-d0e8-4347-869f-efa568955e9d", "names": [ "WYProxy64.sys", "WYProxy32.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [], "resources": [ "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": true, "permalink": "https://virtualized.pro/drivers#wyproxy64" }, { "slug": "xhunter1", "id": "96ba5e53-6a40-4813-b6f1-ccce31a883cf", "names": [ "xhunter1.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2026-3609" ], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [ "Wellbia.com Co., Ltd." ], "resources": [ "https://github.com/BlackSnufkin/BYOVD/tree/main/Xhunter1-Killer", "https://web.archive.org/web/20180820182619/https://x86.re/blog/xigncode3-xhunter1.sys-lpe/", "https://blacksnufkin.github.io/posts/Hunting-the-Hunter/", "https://github.com/BlackSnufkin/AxHunter", "https://www.cve.org/CVERecord?id=CVE-2026-3609" ], "sampleCount": 2, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#xhunter1" }, { "slug": "xhunter2", "id": "ed3abb66-c577-44b8-89fa-80d300c82373", "names": [ "xhunter2.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2026-15430" ], "mitreId": "T1562.001", "verified": true, "created": "2026-08-28", "companies": [ "Wellbia.com Co., Ltd." ], "resources": [ "https://blacksnufkin.github.io/posts/Hunting-the-Hunter-II/", "https://github.com/BlackSnufkin/AxHunter", "https://www.cve.org/CVERecord?id=CVE-2026-15430" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#xhunter2" }, { "slug": "xjokercontroller", "id": "b3fd8560-79d3-40b7-b05f-c78044176c8c", "names": [ "xjokercontroller.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#xjokercontroller" }, { "slug": "xkpsm", "id": "767ed0a0-606b-4297-a858-e2af5b4a0400", "names": [ "xkpsm.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-06-16", "companies": [ "Jiransoft Co. Ltd." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/343" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#xkpsm" }, { "slug": "xlha", "id": "d0de6c54-2dd8-4e32-a2a7-c6c26dcd2a0f", "names": [ "XLHA.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-04-17", "companies": [ "LG Electronics Inc." ], "resources": [ "https://github.com/magicsword-io/LOLDrivers/issues/324", "https://github.com/KeServiceDescriptorTable/vulnerable-drivers" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#xlha" }, { "slug": "yyprotect64", "id": "12ccd18a-11da-495a-b4b4-98a2f2bff180", "names": [ "yyprotect64.sys" ], "category": "vulnerable driver", "cve": [ "" ], "mitreId": "T1068", "verified": true, "created": "2023-07-22", "companies": [], "resources": [ "https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "none", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#yyprotect64" }, { "slug": "zam64", "id": "e5f12b82-8d07-474e-9587-8c7b3714d60c", "names": [ "zam64.sys", "zamguard32.sys", "zamguard64.sys" ], "category": "vulnerable driver", "cve": [ "CVE-2018-5713" ], "mitreId": "T1068", "verified": true, "created": "2023-01-09", "companies": [ "Zemana Ltd.", "Zmana Ltd." ], "resources": [ "Internal Research", "https://www.reddit.com/r/crowdstrike/comments/13wjrgn/20230531_situational_awareness_spyboy_defense/", "https://github.com/elastic/protections-artifacts/search?q=VulnDriver", "https://www.trendmicro.com/en_us/research/23/e/attack-on-security-titans-earth-longzhi-returns-with-new-tricks.html", "https://github.com/ZeroMemoryEx/Terminator" ], "sampleCount": 13, "hvciLoadableCount": 11, "hvciStatus": "bypass", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#zam64" }, { "slug": "zntport", "id": "8fcec30c-f5ca-4aae-b2d8-77af60b78d42", "names": [ "zntport.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1068", "verified": true, "created": "2026-08-11", "companies": [ "Zeal SoftStudio" ], "resources": [ "https://github.com/The-Sword-of-Constantine/UsingBYOVD/blob/master/RawDriverFiles/zntport.sys", "https://www.zealsoftstudio.com/ntport/portfaq.html" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#zntport" }, { "slug": "zyarkit", "id": "f2032ff3-9c67-4d48-981b-2479babb153d", "names": [ "ZYArKit.sys" ], "category": "vulnerable driver", "cve": [], "mitreId": "T1562.001", "verified": true, "created": "2026-06-16", "companies": [ " " ], "resources": [ "https://github.com/KOSEC-LLC/BYOVD-Research/tree/main/V-secure" ], "sampleCount": 1, "hvciLoadableCount": 0, "hvciStatus": "not-evaluated", "msBlocked": false, "permalink": "https://virtualized.pro/drivers#zyarkit" } ], "microsoftBlockedFamilies": [ { "name": "passmark directio.sys", "denyHashCount": 42 }, { "name": "netfilterdrv.sys", "denyHashCount": 22 }, { "name": "asio32.sys", "denyHashCount": 12 }, { "name": "asio64.sys", "denyHashCount": 12 }, { "name": "gameink.sys", "denyHashCount": 8 }, { "name": "lgdcatcher.sys", "denyHashCount": 8 }, { "name": "msio.sys", "denyHashCount": 8 }, { "name": "81.sys", "denyHashCount": 6 }, { "name": "05f052_4045ae_694848_8cb62c_b1d962", "denyHashCount": 4 }, { "name": "32-bit dell dbutil.sys", "denyHashCount": 4 }, { "name": "64-bit dell dbutil.sys", "denyHashCount": 4 }, { "name": "6c6a4d07e95ab4212c2afefcb0ce37dc485fa56120b0419b636bd8bd326038c1.sys", "denyHashCount": 4 }, { "name": "asrdrv10.sys", "denyHashCount": 4 }, { "name": "asrdrv101.sys", "denyHashCount": 4 }, { "name": "asrdrv102.sys", "denyHashCount": 4 }, { "name": "asrdrv103.sys", "denyHashCount": 4 }, { "name": "asupio64.sys", "denyHashCount": 4 }, { "name": "bs_flash64.sys", "denyHashCount": 4 }, { "name": "bs_hwmio64.sys", "denyHashCount": 4 }, { "name": "capcom.sys", "denyHashCount": 4 }, { "name": "fiddrv.sys", "denyHashCount": 4 }, { "name": "fiddrv64.sys", "denyHashCount": 4 }, { "name": "fidpcidrv.sys", "denyHashCount": 4 }, { "name": "fidpcidrv64.sys", "denyHashCount": 4 }, { "name": "glckio2.sys", "denyHashCount": 4 }, { "name": "gvcidrv64.sys", "denyHashCount": 4 }, { "name": "irec32--1.sys", "denyHashCount": 4 }, { "name": "irec32--10.sys", "denyHashCount": 4 }, { "name": "irec32--11.sys", "denyHashCount": 4 }, { "name": "irec32--2.sys", "denyHashCount": 4 }, { "name": "irec32--3.sys", "denyHashCount": 4 }, { "name": "irec32--5.sys", "denyHashCount": 4 }, { "name": "irec32--7.sys", "denyHashCount": 4 }, { "name": "irec32--8.sys", "denyHashCount": 4 }, { "name": "irec32--9.sys", "denyHashCount": 4 }, { "name": "irec64--16.sys", "denyHashCount": 4 }, { "name": "irec64--17.sys", "denyHashCount": 4 }, { "name": "irec64--18.sys", "denyHashCount": 4 }, { "name": "irec64--19.sys", "denyHashCount": 4 }, { "name": "irec64--21.sys", "denyHashCount": 4 }, { "name": "irec64--23.sys", "denyHashCount": 4 }, { "name": "irec64--24.sys", "denyHashCount": 4 }, { "name": "irec64--25.sys", "denyHashCount": 4 }, { "name": "irec64--26.sys", "denyHashCount": 4 }, { "name": "irec64--27.sys", "denyHashCount": 4 }, { "name": "irec64--28.sys", "denyHashCount": 4 }, { "name": "irecarm64--45.sys", "denyHashCount": 4 }, { "name": "phymemx64", "denyHashCount": 4 }, { "name": "piddrv.sys", "denyHashCount": 4 }, { "name": "piddrv64.sys", "denyHashCount": 4 }, { "name": "protects.sys", "denyHashCount": 4 }, { "name": "semav6msr64.sys", "denyHashCount": 4 }, { "name": "winflash64.sys", "denyHashCount": 4 }, { "name": "winring0.sys", "denyHashCount": 4 }, { "name": "1.sys", "denyHashCount": 2 }, { "name": "2.sys", "denyHashCount": 2 }, { "name": "80.sys", "denyHashCount": 2 }, { "name": "b.sys", "denyHashCount": 2 }, { "name": "b1.sys", "denyHashCount": 2 }, { "name": "b3.sys", "denyHashCount": 2 }, { "name": "b4.sys", "denyHashCount": 2 }, { "name": "black.sys", "denyHashCount": 2 }, { "name": "blackbonedrv10.sys", "denyHashCount": 2 }, { "name": "bw.sys", "denyHashCount": 2 }, { "name": "bwrs.sys", "denyHashCount": 2 }, { "name": "bwrsh.sys", "denyHashCount": 2 }, { "name": "c.sys", "denyHashCount": 2 }, { "name": "cpupress.sys", "denyHashCount": 2 }, { "name": "d.sys", "denyHashCount": 2 }, { "name": "d2.sys", "denyHashCount": 2 }, { "name": "d3.sys", "denyHashCount": 2 }, { "name": "d4.sys", "denyHashCount": 2 }, { "name": "full.sys", "denyHashCount": 2 }, { "name": "gametersafe.sys", "denyHashCount": 2 }, { "name": "kbdcap64.sys", "denyHashCount": 2 }, { "name": "lurker.sys", "denyHashCount": 2 }, { "name": "my.sys", "denyHashCount": 2 }, { "name": "netflt.sys", "denyHashCount": 2 }, { "name": "netproxydriver.sys", "denyHashCount": 2 }, { "name": "ni.sys", "denyHashCount": 2 }, { "name": "nstr.sys", "denyHashCount": 2 }, { "name": "nstrwsk.sys", "denyHashCount": 2 }, { "name": "nt2.sys", "denyHashCount": 2 }, { "name": "nt3.sys", "denyHashCount": 2 }, { "name": "nt4.sys", "denyHashCount": 2 }, { "name": "nt5.sys", "denyHashCount": 2 }, { "name": "nt6.sys", "denyHashCount": 2 }, { "name": "proxy32.sys", "denyHashCount": 2 }, { "name": "proxy64.sys", "denyHashCount": 2 }, { "name": "t.sys", "denyHashCount": 2 }, { "name": "t3.sys", "denyHashCount": 2 }, { "name": "t7.sys", "denyHashCount": 2 }, { "name": "t8.sys", "denyHashCount": 2 }, { "name": "testbone.sys", "denyHashCount": 2 }, { "name": "tgsafe.sys", "denyHashCount": 2 }, { "name": "windows-xp-64.sys", "denyHashCount": 2 }, { "name": "windows7-32.sys", "denyHashCount": 2 }, { "name": "windows8-10-32.sys", "denyHashCount": 2 }, { "name": "wyproxy32.sys", "denyHashCount": 2 }, { "name": "wyproxy64.sys", "denyHashCount": 2 }, { "name": "hp ssport.sys", "denyHashCount": 1 }, { "name": "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b fileattribute", "denyHashCount": 0 }, { "name": "001e3ecc4c3294712b8a80ad21b6ba952acfdd9f8297eb7dda3ac1d932eaa15e fileattribute", "denyHashCount": 0 }, { "name": "0025d232ed0ff9a572f8004094cfe21f62070db832398345425554334e036da6 fileattribute", "denyHashCount": 0 }, { "name": "006e089d3e53a5d3cd55ea7dd7b629e4aae3fbd96ee236b88306ab78236c36ee fileattribute", "denyHashCount": 0 }, { "name": "0083e0e95bd2960f983516c0aac7cb8878c6906fc6a1ed1a751bc2ce12f79b3b fileattribute", "denyHashCount": 0 }, { "name": "00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c fileattribute", "denyHashCount": 0 }, { "name": "0184b8314b3ddb11dd929b3ad9e4302f8246e99027077e42d7fc14b25d799428 fileattribute", "denyHashCount": 0 }, { "name": "01af9b2e49907308312be623a125a4cd71da9e626a54dfa746336e5d69c0a70a fileattribute", "denyHashCount": 0 }, { "name": "021badff5a3c84ee422d9fa40a842f89b1c60e0164eabd58da7374327ea99d3c fileattribute", "denyHashCount": 0 }, { "name": "023d722cbbdd04e3db77de7e6e3cfeabcef21ba5b2f04c3f3a33691801dd45eb fileattribute", "denyHashCount": 0 }, { "name": "02bf867ca3f4bd7f3d2829f4eaf0ad10a32e67e7c976f80ef0d1009c2d9cdf25 fileattribute", "denyHashCount": 0 }, { "name": "02fa3060a8319f0f691547345863679d750bfea0974798ffcd379ee965bce83d fileattribute", "denyHashCount": 0 }, { "name": "030ec373e4eb92592cbfc5e590ddbcbc5ece2d43809b141bb3fffceb0e01f72e fileattribute", "denyHashCount": 0 }, { "name": "036c1151a30a9c25afc961d7305c58cbf8f68e5e5c1e726565c9a8168c2f3cdb fileattribute", "denyHashCount": 0 }, { "name": "04e9a85d89a5119ff2dd2342719f6129d42627e3083559c88d4f3be607dd1f06 fileattribute", "denyHashCount": 0 }, { "name": "053b5bc1d35c76f2e9574f8403c2f5ce07b9a44d00495ce546662d4c0476fd2d fileattribute", "denyHashCount": 0 }, { "name": "05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686 fileattribute", "denyHashCount": 0 }, { "name": "05f7419335418b1eb5c983860a8a68e73147508b31e7cb1341a9dbeeb81f96b4 fileattribute", "denyHashCount": 0 }, { "name": "061d9e1cbb06bee5bad025bbc190de1d83bc8298610a6eb525102d9600cfd683 fileattribute", "denyHashCount": 0 }, { "name": "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf fileattribute", "denyHashCount": 0 }, { "name": "06a5d8632ecdd64da4e44ddf3495a62657b513b1139cb8a3a78f641d4e31bf95 fileattribute", "denyHashCount": 0 }, { "name": "070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103 fileattribute", "denyHashCount": 0 }, { "name": "07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8 fileattribute", "denyHashCount": 0 }, { "name": "083ff41609e2c0402f20cc00da1110a0cb80c515ca1c2f551606ecc94986cff9 fileattribute", "denyHashCount": 0 }, { "name": "08675796b8712e0e4ccbdf7831450b907bb94c2e3e85560d9aba1b24931f0d55 fileattribute", "denyHashCount": 0 }, { "name": "0997b76ab0fc63f2d7056cb0da1ae55d076cda74b973826008c69d6dab49987f fileattribute", "denyHashCount": 0 }, { "name": "0aa79d4c5c3baca0aee095bdbdfddfe70fad495c791066c416bd732eaec2d965 fileattribute", "denyHashCount": 0 }, { "name": "0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57 fileattribute", "denyHashCount": 0 }, { "name": "0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e fileattribute", "denyHashCount": 0 }, { "name": "0be8483c2ea42f1ce4c90e84ac474a4e7017bc6d682e06f96dc1e31922a07b10 fileattribute", "denyHashCount": 0 }, { "name": "0c003e038173bfa30069b09f99712780a293328abbc91633b07751246c0ef149 fileattribute", "denyHashCount": 0 }, { "name": "0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180 fileattribute", "denyHashCount": 0 }, { "name": "0d383e469d0e27ebb713770f01f7f1a57068a7d30478221e6f2276125048d1c9 fileattribute", "denyHashCount": 0 }, { "name": "0dd9daf0852a5b1b436199e9f2bf318f641f43173ab0dc22ad8c7e9cbaee9ad3 fileattribute", "denyHashCount": 0 }, { "name": "1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a fileattribute", "denyHashCount": 0 }, { "name": "11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359 fileattribute", "denyHashCount": 0 }, { "name": "12b3d8bc5cc1ea6e2acd741d8a80f56cf2a0a7ebfa0998e3f0743fcf83fabb9e fileattribute", "denyHashCount": 0 }, { "name": "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980 fileattribute", "denyHashCount": 0 }, { "name": "15ffa1952b4018e4c07a5caf53d650a792b4872fa806deb8e22ccce69e6def6e fileattribute", "denyHashCount": 0 }, { "name": "174c8d771d31d70fc95448e961a395f5ceb7658f0cc381a718fb3b854cde4efe fileattribute", "denyHashCount": 0 }, { "name": "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229 fileattribute", "denyHashCount": 0 }, { "name": "17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d fileattribute", "denyHashCount": 0 }, { "name": "1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb fileattribute", "denyHashCount": 0 }, { "name": "1dccd1e13da17bd541a66b48d62e914df390818c15f5f599c636d42c05996ace fileattribute", "denyHashCount": 0 }, { "name": "1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d fileattribute", "denyHashCount": 0 }, { "name": "1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718 fileattribute", "denyHashCount": 0 }, { "name": "223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1 fileattribute", "denyHashCount": 0 }, { "name": "24342de3b93a06b4e4534140b13cd0726e8e8f4665866a9dcbcceb5685b83cf3 fileattribute", "denyHashCount": 0 }, { "name": "265259015d4fda3e9d14b7740b8153b9097ab054cf6873b46f9fefdc97266d35 fileattribute", "denyHashCount": 0 }, { "name": "270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc fileattribute", "denyHashCount": 0 }, { "name": "29f449fca0a41deccef5b0dccd22af18259222f69ed6f389beafe8d5168c59e36 fileattribute", "denyHashCount": 0 }, { "name": "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4 fileattribute", "denyHashCount": 0 }, { "name": "2b34ca35bd4f61d8e1d62b6129bef0a64c4655e80d6d39da06cb27c08e6996a3 fileattribute", "denyHashCount": 0 }, { "name": "2b507e0ad4515d9d47fb7f0bfa1f1eb11de25db4fca49fc1417ea991dc33b6bf fileattribute", "denyHashCount": 0 }, { "name": "2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f fileattribute", "denyHashCount": 0 }, { "name": "33a73e36499d4a33f9321c5ac40a4e34c029a2d7ea26205a245592df78195776.sys fileattribute", "denyHashCount": 0 }, { "name": "37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20 fileattribute", "denyHashCount": 0 }, { "name": "37507cdb5df5669862f0213feb521dc82a3c87b85c5489bbffdaedd1c43da132 fileattribute", "denyHashCount": 0 }, { "name": "3807e9a1bc159b9e8fc0c7caad10d7213ff8ed8ad1cea9ea552b093c81bf624b fileattribute", "denyHashCount": 0 }, { "name": "3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8 fileattribute", "denyHashCount": 0 }, { "name": "3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d fileattribute", "denyHashCount": 0 }, { "name": "40b62ba97ba2edd3e01ed62d26ae8c09f36144ab33db18b42e5f1ccf82db1754 fileattribute", "denyHashCount": 0 }, { "name": "455ff5274fbdd19ce1da6fc6725a00752761998759c6bacb9713081f613c1752 fileattribute", "denyHashCount": 0 }, { "name": "45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271.sys fileattribute", "denyHashCount": 0 }, { "name": "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8 fileattribute", "denyHashCount": 0 }, { "name": "4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe fileattribute", "denyHashCount": 0 }, { "name": "507b07b0dc0e638b65b4a4d11a462b35439c746d42337b9888927bf994176102 fileattribute", "denyHashCount": 0 }, { "name": "530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb fileattribute", "denyHashCount": 0 }, { "name": "5b0ebf255769224b95d23ff0511014ae80ad8778737d6aaa071aeb794012b058 fileattribute", "denyHashCount": 0 }, { "name": "68ca1b5151181a98cd6da55d6dfd6ef0c94f0cf9379be37a8f86dd996d677946 fileattribute", "denyHashCount": 0 }, { "name": "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74 fileattribute", "denyHashCount": 0 }, { "name": "70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505 fileattribute", "denyHashCount": 0 }, { "name": "770ab79212b08cd13864d6cfd9b97180d7b3f084d1d44aec09c8314d9466039e fileattribute", "denyHashCount": 0 }, { "name": "7c6f16af074c3f1c74fc69734f1c8b8a03b0594ac2085d5a0c582fc8cc378858 fileattribute", "denyHashCount": 0 }, { "name": "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7 fileattribute", "denyHashCount": 0 }, { "name": "87ece1b3b8446517dd9696a1b2c62f82a80220956618485efbdf5671f2676616 fileattribute", "denyHashCount": 0 }, { "name": "8dba0ab11ce9f9df5c8fb9fff18bbe9c8c654864053c8b0c4f175ec7203a2e51 fileattribute", "denyHashCount": 0 }, { "name": "8ec9a4c4ec2b73440c591bc91543d0f685ffa1c3658926b25b06d929c5b6feed fileattribute", "denyHashCount": 0 }, { "name": "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c fileattribute", "denyHashCount": 0 }, { "name": "a3908b3fa59c0fc7600ff8887a87861a4f8566ca0a3bdcf2371bb9f36745db91 fileattribute", "denyHashCount": 0 }, { "name": "a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec fileattribute", "denyHashCount": 0 }, { "name": "agnitum sandbox fileattribute", "denyHashCount": 0 }, { "name": "amdpowerprofiler.sys fileattribute", "denyHashCount": 0 }, { "name": "amdryzenmaster.sys", "denyHashCount": 0 }, { "name": "asus ashitio_drv fileattribute", "denyHashCount": 0 }, { "name": "asus memory mapping driver", "denyHashCount": 0 }, { "name": "atillk64 fileattribute", "denyHashCount": 0 }, { "name": "atszio.sys fileattribute", "denyHashCount": 0 }, { "name": "avast aswarpot fileattribute", "denyHashCount": 0 }, { "name": "avast aswelam/avgelam overpermissive elam fileattribute", "denyHashCount": 0 }, { "name": "b80bea4c09dafb0bfd2ca067130a7ead64faba8f78599dad4d4291a4a29f3a23 fileattribute", "denyHashCount": 0 }, { "name": "bs_def fileattribute", "denyHashCount": 0 }, { "name": "bs_def64 fileattribute", "denyHashCount": 0 }, { "name": "bsmem64_w10 fileattribute", "denyHashCount": 0 }, { "name": "c02eabc2e096f00e6e46fb3b5cf0062db5e1b9d92877b701d2ea0bf27cd82cbe fileattribute", "denyHashCount": 0 }, { "name": "c3a2dade7d95085d5af4bf9dc218c97f802440b6c1bd2fdac520cb1a376b7e84 fileattribute", "denyHashCount": 0 }, { "name": "cheat engine driver", "denyHashCount": 0 }, { "name": "creative tech msio32.sys fileattribute", "denyHashCount": 0 }, { "name": "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e fileattribute", "denyHashCount": 0 }, { "name": "d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e fileattribute", "denyHashCount": 0 }, { "name": "deny fairplaykd.sys mta san andreas versions 367.*", "denyHashCount": 0 }, { "name": "ef55a5a3be73d5bfc5aa2a2b3f0cc574b824d96a129a67931a1667e770d5d938 fileattribute", "denyHashCount": 0 }, { "name": "eset eelam overpermissive elam fileattribute", "denyHashCount": 0 }, { "name": "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960 fileattribute", "denyHashCount": 0 }, { "name": "fileattribute", "denyHashCount": 0 }, { "name": "gdrv.sys", "denyHashCount": 0 }, { "name": "gmerek gmer64 fileattribute", "denyHashCount": 0 }, { "name": "haxm.sys fileattribute", "denyHashCount": 0 }, { "name": "hpportiox64.sys", "denyHashCount": 0 }, { "name": "hwrwdrv fileattribute", "denyHashCount": 0 }, { "name": "iobit monitor.sys fileattribute", "denyHashCount": 0 }, { "name": "iobitunlocker fileattribute", "denyHashCount": 0 }, { "name": "iqvw64.sys fileattribute", "denyHashCount": 0 }, { "name": "kaspersky klmd.sys filerule", "denyHashCount": 0 }, { "name": "kevp64.sys fileattribute", "denyHashCount": 0 }, { "name": "kingsoft ksapi.sys fileattribute", "denyHashCount": 0 }, { "name": "kprocesshacker.sys filerule", "denyHashCount": 0 }, { "name": "lenovodiagnosticsdriver fileattribute", "denyHashCount": 0 }, { "name": "lha.sys fileattribute", "denyHashCount": 0 }, { "name": "lv561v64 logitech fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys 21h1 fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys 21h2 fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys 22h2 fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys 23h2 fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys ws2019 fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys ws2022 fileattribute", "denyHashCount": 0 }, { "name": "ms windows appid.sys ws23h2 fileattribute", "denyHashCount": 0 }, { "name": "mtcbsv64.sys fileattribute", "denyHashCount": 0 }, { "name": "mydrivers.sys fileattribute", "denyHashCount": 0 }, { "name": "nvidia nvflash fileattribute", "denyHashCount": 0 }, { "name": "pchunter driver", "denyHashCount": 0 }, { "name": "phymem fileattribute", "denyHashCount": 0 }, { "name": "phymemx64 memory mapping driver", "denyHashCount": 0 }, { "name": "physmem.sys fileattribute", "denyHashCount": 0 }, { "name": "razer rzpnk.sys fileattribute", "denyHashCount": 0 }, { "name": "realix_hwinfo32 fileattribute", "denyHashCount": 0 }, { "name": "realix_hwinfo64a fileattribute", "denyHashCount": 0 }, { "name": "realix_hwinfo64i fileattribute", "denyHashCount": 0 }, { "name": "segwindrvx64.sys fileattribute", "denyHashCount": 0 }, { "name": "signers of known vulnerable or malicious drivers", "denyHashCount": 0 }, { "name": "superbmc fileattribute", "denyHashCount": 0 }, { "name": "sysinternals process explorer fileattribute", "denyHashCount": 0 }, { "name": "system mechanic cve-2018-5701", "denyHashCount": 0 }, { "name": "tmcomm.sys", "denyHashCount": 0 }, { "name": "trendmicro tmel overpermissive elam fileattribute", "denyHashCount": 0 }, { "name": "viragt.sys 32-bit", "denyHashCount": 0 }, { "name": "viragt64.sys", "denyHashCount": 0 }, { "name": "vmdrv.sys fileattribute", "denyHashCount": 0 }, { "name": "wiseunlo fileattribute", "denyHashCount": 0 } ] }