Introducing: GhostKatz! 🐱
A Cobalt Strike BOF that lets you dump LSASS via exploitation of vulnerable drivers that offer physical memory read primitives.
Written by @EricEsquivel123 and I!! :)
https://t.co/tmuksIKvj8
I don’t know who needs to hear this but your research is your IP not the vendors IP. You can do whatever you want with that IP. Reporting it, publishing it, selling it to a third party or putting it in a box under your bed 🙄
@DoomsdayGoth It’s fine, but always check the code. Some models write unnecessary code with an excessive amount of comments and it bothers me. You can always prompt it better as well. If you are learning to code, I suggest limiting your use.
The https://t.co/GQYFpObADC project just had its biggest month ever. 🙌
In April alone, we merged 12 PRs adding 90+ new vulnerable kernel driver entries to the database. LOLDrivers now tracks 615 unique drivers across 2,121 known vulnerable samples.
Here’s what the updated security metrics dashboard shows:
✅460 samples (21.7%) load despite HVCI / Memory Integrity being enabled
✅1,523 samples (72.7%) are LOLDrivers-exclusive, meaning they are NOT covered by Microsoft’s recommended vulnerable driver blocklist
✅Only 573 samples overlap with Microsoft’s block rules
That gap matters. Legitimate signed drivers from Intel, AMD, HP, Corsair, ASUS, Dell, Clevo, Beckhoff, National Instruments, and dozens of other vendors are being actively weaponized in BYOVD (Bring Your Own Vulnerable Driver) attacks. Threat actors use these drivers to disable EDR/AV, escalate privileges, and bypass kernel security controls, all with validly signed code that Windows trusts by default.
ESET’s March 2026 research documented 54 EDR killers exploiting 35 vulnerable drivers. Akira and MedusaLocker ransomware operators are abusing ThrottleStop.sys. Process-kill drivers like DsArk64.sys (WHQL Microsoft-signed) can terminate PPL-protected processes with a single 4-byte IOCTL.
If your organization isn’t actively managing application control policies that address vulnerable drivers, you have a significant blind spot. Tools like LOLDrivers give defenders the data they need to close it.
Huge thanks to the security researchers who made this sprint possible, your contributions directly improve the defensive community’s ability to detect and block these threats.
Special thanks to @weezerOSINT , @rainbowdynamix , @DbgPrint and the KeServiceDescriptorTable project.
#BYOVD #LOLDrivers #WDAC #KernelSecurity #ThreatIntel #EDR #VulnerableDrivers
I just dropped some research: DSCourier and would love for your opinion and to check it out!!
It’s a novel post-exploitation technique abusing WinGet’s COM API to execute code through Microsoft-signed binaries.
GitHub: https://t.co/pgIhifT5cT
Blog: https://t.co/kgeBvZw06N