truesight

truesight.sys is the kernel driver for RogueKiller, a legitimate anti-malware and anti-rootkit tool made by Adlice Software, a French security vendor. The driver provides process-termination and system-inspection primitives that RogueKiller uses to remove deeply embedded threats.

Versions 3.4.0 and below expose an arbitrary process-termination IOCTL (0x22E044) that can kill protected processes, including endpoint protection software. No formal CVE has been assigned, but the vulnerability is well-documented in the security research community. What makes truesight.sys distinctive in the BYOVD landscape is scale: Check Point Research documented over 2,500 distinct variants of the driver in the wild, all built from a legacy version (2.0.2) signed before July 2015. Attackers exploited a Windows policy loophole that still loads drivers signed before that date, then modified 8 bytes in the PE header (CheckSum and certificate padding) to generate unique hashes that evade hash-based blocklists while keeping the digital signature valid.

The Silver Fox APT group used these variants in a campaign targeting users in China, Singapore, and Taiwan, deploying HiddenGh0st RAT after the driver disabled endpoint protection. RansomHub, Qilin, INC, and BlackCat operators have also been documented using truesight.sys. Microsoft updated the Windows Vulnerable Driver Blocklist in December 2024 to cover the known variants.

If you use RogueKiller, keep it updated to version 3.4.0 or later. If you find an older truesight.sys on a system where RogueKiller was never installed, investigate what placed it there.

truesight is listed as a known-vulnerable driver on the public LOLDrivers project. 2 distinct binary hashes matching this filename are on record, meaning multiple versions of the file have been observed.