RCFlCtrl.sys ("RedCastle Control Driver"): one IOCTL terminates arbitrary processes from the kernel, the same primitive EDR killers rely on. Reported to MITRE in December 2025 with no response, so no CVE yet.
https://www.loldrivers.io/drivers/a7d2a088-b00b-4f5c-96ca-7a98070dddd5/
LOLDriversRCFlCtrl.sys – Vulnerable Driver & Hashes | LOLDriversRCFlCtrl.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance.
fekern.sys ships with the Trellix HX Agent (formerly FireEye). Dropped on a machine without HX, it can read LSASS memory and escalate to SYSTEM (CVE-2025-14963). Fixed builds: 35.31.44 and 36.30.37.
https://www.loldrivers.io/drivers/8858c9c8-e570-41ed-a5cc-054d9eb51d40/
LOLDriversfekern.sys – Vulnerable Driver & Hashes | LOLDriversfekern.sys is a known vulnerable driver abused for BYOVD. Get hashes, detection rules and blocklist guidance. CVE: CVE-2025-14963.
