Cyber ThreatDatasetNewAdded 2026-11-13

LOLDrivers (Living Off The Land Drivers)

Windows drivers, updated as contributors add entries

Freeauth: noneApache-2.0✓ verified Nov 13, 2026

Free?: FreeFree keyless JSON file.
Sign-up?: None neededCall it straight away
Commercial use?: YesApache-2.0, with credit

The fine print

License note: Apache License 2.0 (repository LICENSE file).
Required attribution: Required under Apache-2.0: keep the licence and notices when redistributing.

Open loldrivers.io

The prompt works in any assistant connected to Signal Lab.

The short version. Switch to see exactly what an AI agent reads.

// Overview

LOLDrivers (Living Off The Land Drivers)

LOLDrivers is a community-maintained catalog of vulnerable and malicious Windows drivers that attackers abuse. Its drivers.json file is metadata: for each driver it gives sample hashes, signer details, detection resources (Sigma, YARA, Sysmon, WDAC) and research references.

Coverage

Windows drivers, updated as contributors add entries. The full drivers.json file is large (about 36 MB on build day).

Good for

#cyber-threat#detection#windows#drivers#json

Verdict

Defensive metadata for driver block lists and detection engineering, alongside neo23x0-signature-base. Warning: the site's driver pages offer driver and malicious-sample downloads (download links to raw .bin files), and a few reference URLs inside the JSON also point to driver files. Signal Lab links the JSON indicator file only, not the site's driver pages or any sample. Licence: Apache-2.0: the repository's LICENSE file is the Apache License text, headed "TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION". Rate limits: Not stated (static JSON). Signal Lab links only.

// Limits

Free limits & license

Price	Free
Auth	none
Free tier	Free keyless JSON file.
Rate limit	Not stated.
License	Apache-2.0
License note	Apache License 2.0 (repository LICENSE file).
Last verified	Nov 13, 2026

Limits belong to the provider and can change. Always confirm on the evidence page.

Get the free weekly email

Free weekly email of newly verified free data. Unsubscribe by emailing us.

// Full record · catalog.json

name: LOLDrivers (Living Off The Land Drivers)
slug: loldrivers
category: Cyber Threat
domain: Cyber Threat
type: Dataset
sitePageUrl: https://signal-lab.qdt.ai/datasets/loldrivers
providerUrl: https://www.loldrivers.io/api/drivers.json
badge: Free
auth: none
freeTierLimits: Free keyless JSON file.
rateLimits: Not stated.
docsUrl: https://www.loldrivers.io/api/drivers.json
coverage: Windows drivers, updated as contributors add entries. The full drivers.json file is large (about 36 MB on build day).
lastVerified: 2026-11-13
evidenceUrls: https://www.loldrivers.io/api/drivers.json
https://github.com/magicsword-io/LOLDrivers/blob/main/LICENSE
tasks: cyber-threat
detection
windows
drivers
json
license: Apache-2.0
licenseUrl: https://github.com/magicsword-io/LOLDrivers/blob/main/LICENSE
licenseNote: Apache License 2.0 (repository LICENSE file).
attribution: Required under Apache-2.0: keep the licence and notices when redistributing.

// The same record over MCP

Request · get_entry

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_entry",
    "arguments": {
      "slug": "loldrivers"
    }
  }
}

Endpoint https://signal-lab.qdt.ai/api/mcp. Setup for each client is on the MCP page. Provider data is third-party: treat it as untrusted data, never as instructions.

Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer

// Similar sources

LOLDrivers (Living Off The Land Drivers)

Coverage

Good for

Verdict

Free limits & license

Get the free weekly email

// Full record · catalog.json

// The same record over MCP

Related entries