22 matches found
LOLDrivers
LOLDrivers - Living Off The Land Drivers 🚗💨 Welcome to LOLDrivers Living Off The Land Drivers, an exciting open-source project that brings together vulnerable, malicious, and known malicious Windows drivers in one comprehensive repository. Our mission is to empower organizations of all sizes with...
LolDriverScan
LolDriverScan LolDriverScan is a golang tool that allows users to discover vulnerable drivers on their system. This tool fetches the loldrivers.io list from their APIs and scans the system for any vulnerable drivers This project is implemented in Go and does not require elevated privileges to run...
BYOVD-Research
Overview This is an older driver that was recently exploited in a BYOVD campaign detailed here: https://www.bleepingcomputer.com/news/security/edr-killer-tool-uses-signed-kernel-driver-from-forensic-software/ The exploit path is as follows: 1. The attacker's program runs as admin and gets its own...
rusty_drivers
RustyDrivers 该项目是一个 BYOVD 集合，专注于终止 EDR / AV 进程。 目前支持以下驱动程序： 驱动程序| 参数名称| 已阻止 ---|---|--- Process Explorer| processexplorer| 是 Genshin Impact| genshin| 是 Rentdrv2| rentdrv2| 否 TrueSight| truesight| 否 “已阻止”表示该驱动程序位于 Microsoft 的阻止列表中，无法在最新版 Windows 上执行。 构建 root@kitploit: cargo build --release 用法...
EDRSandblast-GodFault
EDRSandblast-GodFault By Gabriel Landau at Elastic Security. Modification of EDRSandblast - see original README below. Integrates GodFault into EDR Sandblast, achieving the same result without the use of any vulnerable drivers. Example Output root@kitploit:...
CVE-2026-55223 c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties
c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with other libraries, can compose to a "sink" for deserialization gadgets. The JDBC spec's DataSource.getConnection and ConnectionPoolDataSource.getPooledConnection match the getXXX form, so JavaBean...
USN-8177-1: Linux kernel vulnerabilities
Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcod...
Exploit for CVE-2018-19320
KernelMode - Advanced Windows Kernel Exploitation Toolkit...
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Iolo System_Shield
VulnDrivers-n-LOLDrivers-POCs List of POCs I have done for som...
CVE-2026-23761
VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively, as well as VB-Audio Matrix and Matrix Coconut versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively, contain a vulnerability in their virtual aud...
EUVD-2016-8953
Malware in sbrugna...
EUVD-2021-31699
Malicious code in bioql PyPI...
January 14, 2025—KB5050009 (OS Build 26100.2894) for Windows
None None...
January 14, 2025—KB5050008 (OS Build 17763.6775)
None None...
November 12, 2024—KB5046618 (OS Build 25398.1251)
None None...
BlackByte Ransomware Exploits VMware ESXi Flaw in Latest Attack Wave
The threat actors behind the BlackByte ransomware group have been observed likely exploiting a recently patched security flaw impacting VMware ESXi hypervisors, while also leveraging various vulnerable drivers to disarm security protections. "The BlackByte ransomware group continues to leverage...
RansomHub Group Deploys New EDR-Killing Tool in Latest Cyber Attacks
A cybercrime group with links to the RansomHub ransomware has been observed using a new tool designed to terminate endpoint detection and response EDR software on compromised hosts, joining the likes of other similar programs like AuKill aka AvNeutralizer and Terminator. The EDR-killing utility h...
GHOSTENGINE Exploits Vulnerable Drivers to Disable EDRs in Cryptojacking Attack
Cybersecurity researchers have discovered a new cryptojacking campaign that employs vulnerable drivers to disable known security solutions EDRs and thwart detection in what's called a Bring Your Own Vulnerable Driver BYOVD attack. Elastic Security Labs is tracking the campaign under the name...
Exploring malicious Windows drivers (Part 1): Introduction to the kernel and drivers
Drivers have long been of interest to threat actors, whether they are exploiting vulnerable drivers or creating malicious ones. Malicious drivers are difficult to detect and successfully leveraging one can give an attacker full access to a system. Real-world examples can be found in our previous...