Hunting vulnerable drivers with the LOLDrivers feed
Why a validly signed kernel driver is the weakest link on a hardened endpoint
A validly signed kernel driver is the weakest link because signature enforcement asks who published an image and never what that image lets a caller do. In a bring your own vulnerable driver attack, an operator holding local administrator rights loads a legitimate, correctly signed driver and uses its own exposed functionality to read and write kernel memory, terminate protected processes or blind a monitoring agent. Nothing is forged, every signature check passes, and the abusable code runs at the privilege level of the defences meant to stop it.
Kernel driver analysis grades a .sys file on what it hands to user mode, before anyone loads it.
Key facts
| Item | Value |
|---|---|
| What is graded | A Windows kernel driver, parsed statically, never executed |
| Corpora | The LOLDrivers feed, pulled hourly, plus an operator-supplied vendor block policy |
| Benign baseline | 407 signed drivers from our own Windows 10 golden image |
| Verdict bands | clean, suspicious at 30, vulnerable at 60, malicious at 80 |
What makes a kernel driver abusable
A driver is a service with a published door. It creates a device object, names it with a symbolic link so user mode can open it, and registers a dispatch routine for device control requests. The weakness class here is an unauthenticated dispatch routine: one that turns a request from any caller able to open the device into a kernel operation, without establishing that the caller was entitled to ask, or that the request is in range.
Three primitive families matter more than the rest. An arbitrary physical memory mapping hands a caller a read and write window onto RAM. A privileged hardware register write reaches processor state that governs kernel protections. Terminating an arbitrary process from kernel mode is the primitive a security product cannot defend itself against.
Holding one of those is not the bug. A firmware driver maps physical memory because that is its job: the canonical mapping call is in 1.97 percent of 407 signed first-party drivers. The bug is the conjunction, a rare primitive plus a door user mode can open plus no check in between. No request format or control code appears below; identification does not need them. Terms are defined in the glossary.
Why hash matching against a public corpus is only the first filter
The LOLDrivers project maintains a public corpus of drivers published as abusable. A match is the strongest single static statement available: not "this resembles something bad" but "this file is documented as usable by an attacker". We pull the feed hourly and join on MD5, SHA1, SHA256 and the Authenticode hash.
That last column is the interesting one. It covers the image with the certificate table excluded, so stripping the signature off a known-vulnerable driver moves every flat hash and leaves it alone. A hit there is reported as "the same image, re-signed or stripped of its signature", not as an exact file match.
Two limits keep a corpus from being the answer. It records what has been reported, so a driver shipped last quarter and never written up is absent. And where a file must be known before it can be called anything, a novel vulnerable driver is unreachable: a validly signed third-party driver we measured mapped physical memory behind a device interface and still scored clean, because every published fact was missing.
A vendor block policy reaches identities a flat hash cannot, and needs care of its own: seventeen of its signer rules rest on an identifier absent from the leaf certificate, and matching those on the certificate authority alone would flag nearly every attestation-signed driver, so a match needs a narrowing term.
What static evidence grades a driver nobody has published yet
Each layer is graded against a measured benign base rate.
| Signal | What it means to a reviewer |
|---|---|
| Imported primitive rare in benign drivers | Candidate finding. The physical memory mapping call is in 1.97 percent of the baseline |
| Imported primitive common in benign drivers | Context. One allocation call is in 83.78 percent of signed drivers |
| Privileged instruction in the disassembly | Rare and strong. A control register write appeared in none of the 407 |
| Published exploit control code in executable code | Definitive. The code is published, so tooling for it exists |
| Device object and symbolic link named | The door. A primitive nobody can reach is a hardware driver at work |
Register and port access compile to bare opcodes and never enter an import table, so we read them off a bounded disassembly. Control codes get the same treatment: a byte scan yields tens of thousands of candidates on an ordinary signed driver, so only the immediates the driver compares are kept.
Signature evidence is reported in full and scored lightly. Treating expiry as a red flag was the largest source of false positives in the engine this module was modelled on: ordinary first-party drivers are validly signed and past their certificate window at once.
How the platform combines that evidence into one explainable score
Nine components carry relative weights, and the divisor is the sum of the weights that applied, so a layer with no answer stops being part of the total rather than dragging it down. Corpus membership weighs most at 22, the dispatch surface and imported primitives 18 each, privileged hardware access 16 and signature rules 14; reputation, named vulnerabilities, signing state and packing follow.
An average alone is the wrong shape for this verdict. A driver whose only finding is a published exploit control code in executable code is actionable on that fact, and a mean over nine components will not say so. Definitive facts are counted separately, and enough of them raise the total to a floor, each printed as a sentence beside the number so a reader sees where the answer came from.
"Vulnerable" is a band of its own, not a synonym for suspicious: such a driver is not shown to be malicious, it is shown to carry the thing that makes it usable. The same discipline runs through the platform's file analysis modules.
How a defender turns a driver verdict into a blocklist decision
Block by image identity, not by filename. Renaming a driver is normal in an incident, so a submitted name is only a hint; key the policy on the Authenticode hash, or on the signer plus a version constraint for a family of builds. A verdict of vulnerable or malicious is enough to add that identity to a block policy and to alert on the service install and load events, which the module emits as generated Sigma rules beside the ATT&CK mapping. Field definitions live in the documentation.
Read a clean verdict for what it says: no graded primitive was imported. For a framework-based driver that absence is weak evidence, because the framework owns the dispatch table and those calls never appear. Sample bytes never leave the host; only hashes do, which is the no-upload boundary the platform is built on.
Frequently asked questions
What is a bring your own vulnerable driver attack?
It is a technique in which an attacker who already holds administrative rights loads a legitimate, correctly signed kernel driver that contains an abusable function, then drives that function from user mode to reach kernel memory, kill protected processes or disable monitoring. Signature enforcement passes, because the driver really is signed.
Does a hash match against a public driver corpus prove a file is dangerous?
A hash match proves this exact file, or the same image under a different signature, was published as abusable. That is the strongest static statement available, and it says nothing about drivers nobody has reported yet. Treat a hit as confirmation, and treat silence as absence of evidence, not as a clean result.
Can a driver be flagged as vulnerable without a known hash or a named CVE?
Yes. Static grading asks whether a binary holds a kernel primitive that is rare among benign drivers, whether it publishes a device interface a caller can open, and whether its platform class explains that primitive. A rare primitive behind an openable door, unexplained, earns the vulnerable band.
Should an expired signing certificate raise a driver's risk score?
Not on its own. Authenticode signatures are countersigned with a trusted timestamp, so an image signed years ago stays validly signed after its certificate lapses, and ordinary first-party drivers sit in that state. Expiry matters beside another finding, because an old signed driver is what this attack reuses.