truesight.sys
Adlice TrueSight.sys exposes kernel-mode process termination through IOCTL 0x22E044. Static inspection of the 2.0.2 sample confirms that a caller-supplied PID reaches ZwOpenProcess with PROCESS_TERMINATE and then ZwTerminateProcess. Public Darkside research documents abuse of version 3.3 and reports a fix in 3.4; Check Point describes exploitation of legacy builds. The 2.0.2 submitter reports process termination and automatic restart in a Windows 11 VM. That recording does not establish the target process's PPL status. Loading behavior depends on Windows policy, signing and blocklist state; no general HVCI or WDAC bypass is asserted for the added sample.
Known samples 3
0 recorded TRUE · 1 recorded FALSE · 2 unknown for loading despite HVCI. Results apply to individual samples.
TruesightSample 1 · HVCI FALSE
- MD5
f53fa44c7b591a2be105344790543369- SHA1
363068731e87bcee19ad5cb802e14f9248465d31- SHA256
bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c- Imphash
b95bc1a99081d695b1c0b37b90a4a0be- Authentihash MD5
7ac40b0bee0d9b6e84d58d567e82e736- Authentihash SHA1
13c6de4203098a8017a0bd4c4da98f6d547482bb- Authentihash SHA256
891ad430e7f1d58ef85b437505a6016fa99a72abcfd4734476efc5fc1fcd1cba- Machine
- AMD64
- Version
- 3.3.0
- Publisher
- Adlice Software
TruesightSample 2 · HVCI unknown
- MD5
531121e7ed50084b493a69f8f8a7a927- SHA1
28c37b1c0af4a2a75a9662544fb3181a71c45dd2- SHA256
bfbfcb7cae421739163e7630865009d3197f587265e9e5797142d93e1b72b191- Imphash
ba0a77ce9e566f704a1655d999d41048- Authentihash MD5
e500e54b63b017a00fddcc37a6d47a90- Authentihash SHA1
79573b1d088101b2ebea80da1ab2dbb83725336a- Authentihash SHA256
13a64ee87e5e407cb592026b7d0bed501a2ae5bfaa33312d89e0f62fe4278828- Machine
- AMD64
- Version
- 1.0.3
- Publisher
- Adlice Software
truesight.sysSample 3 · HVCI unknown
- MD5
0d5a09b08568760ae85a801fcbc0f83d- SHA1
3ec1e15b4a903b92e965a44dd9514267c1ceff80- SHA256
347acba74fdcbeac671521739f8a34ec0e378caf716c31f55616f9f843e4d0d3- Imphash
17fec1f996adceb4112879eb84986897- Authentihash MD5
05a8e40ca699688e768a230216655992- Authentihash SHA1
b7ea0d3897e87a7f6380c4729cf6c891d1acaec5- Authentihash SHA256
ecb07e72d6937ab5cee4a7b8176351cbdefa3e0b230a5973b8fc6c2f2c02f30d- Machine
- AMD64
- Version
- 2.0.2
- Publisher
- Adlice Software
Recorded command
sc.exe create truesight.sys binPath=C:\windows\temp\truesight.sys type=kernel && sc.exe start truesight.sysTerminate security processes from kernel mode. · Privileges: Administrator to load the driver; access to its device is required. · OS: Windows
Research & references
Acknowledgement: ph4nt0mbyt3, junho462, bob-dev-byovd @ph4nt0mbyt3, @junho462, @bob-dev-byovd