LOLDrivers YARA Rule Generator

Generates a single YARA rule file (LOLDrivers.yar) for detecting known vulnerable and malicious Windows drivers ("Bring Your Own Vulnerable Driver" / BYOVD), sourced live from the LOLDrivers project.

What it does

The script pulls the full driver dataset from the LOLDrivers API and builds two YARA rules in one output file:

• LOLDrivers_Hash — matches known vulnerable driver binaries by SHA256 hash using YARA's hash module.
• LOLDrivers_Name — matches known vulnerable driver filenames as strings, gated on the presence of ntoskrnl.exe to reduce false positives to kernel-mode contexts.

Every condition is preceded by a comment showing the driver's name and a short description of how it's abused (including a plain-English explanation of any MITRE ATT&CK technique IDs), so you can tell at a glance what each hash or filename corresponds to without looking it up.

Example output

import "hash"

rule LOLDrivers_Hash
{
    meta:
        description = "BYOVD: Detects known vulnerable/malicious drivers by SHA256 hash"
        author      = "FallinBinary (github.com/fallinbinary)"
        source      = "https://www.loldrivers.io/api/drivers.json"
        reference   = "https://www.loldrivers.io"
        generated   = "2026-06-30 12:00:00 UTC"
        hash_count  = "500"

    condition:
        // [Driver: RTCore64, MSI Afterburner] [Use: T1068 (Exploitation for Privilege Escalation) | Hardware monitoring]
        hash.sha256(0, filesize) == "01a4d6212d...c4a0e"
        or
        // [Driver: gdrv, Gigabyte] [Use: T1068 (Exploitation for Privilege Escalation) | Arbitrary kernel R/W via IOCTL]
        hash.sha256(0, filesize) == "5e8e8f2c1b...8d23f"
}

rule LOLDrivers_Name
{
    meta:
        description    = "BYOVD: Detects known vulnerable/malicious drivers by filename"
        author         = "FallinBinary (github.com/fallinbinary)"
        source         = "https://www.loldrivers.io/api/drivers.json"
        reference      = "https://www.loldrivers.io"
        generated      = "2026-06-30 12:00:00 UTC"
        filename_count = "480"

    strings:
        $krnl = "ntoskrnl.exe" nocase ascii wide fullword

        // [Driver: RTCore64, MSI Afterburner] [Use: T1068 (Exploitation for Privilege Escalation) | Hardware monitoring]
        $drv0000 = "RTCore64.sys" nocase ascii wide fullword

        // [Driver: gdrv, Gigabyte] [Use: T1068 (Exploitation for Privilege Escalation) | Arbitrary kernel R/W via IOCTL]
        $drv0001 = "gdrv.sys" nocase ascii wide fullword

    condition:
        $krnl and 1 of ($drv*)
}

Requirements

• Python 3.9+
• No third-party dependencies (uses only the standard library)
• To run the resulting .yar file: YARA compiled with the hash module enabled (default in most builds)

Usage

python3 loldrivers_yara.py

This produces LOLDrivers.yar in the current directory.

To scan a file or directory with the generated rule:

yara -r LOLDrivers.yar /path/to/scan

How driver use-cases are determined

For each driver entry, the script looks for a description in this order of preference:

1. The driver's top-level Usecase field
2. The Description field of any associated Commands
3. The driver's MitreID field(s), expanded into plain-English technique descriptions (e.g. T1068 → "Exploitation for Privilege Escalation — gain elevated privileges")
4. Any Usecase field found on individual KnownVulnerableSamples
5. The driver's Category as a last resort

Any MITRE ATT&CK codes that appear in the resulting text are automatically expanded with a short explanation, and additional relevant codes attached to the driver are appended if not already present.

Regenerating the rule

LOLDrivers is updated frequently as new vulnerable drivers are discovered. Re-run the script periodically (e.g. via a scheduled GitHub Action) to keep LOLDrivers.yar current.

Credits

• Driver data: LOLDrivers.io by the Living Off The Land Drivers project
• Generator script & rules: FallinBinary (github.com/fallinbinary)

License

MIT — see LOLDrivers' own licensing for terms governing the underlying driver dataset.