TrueSight.sys

Adlice RootLaser file version info

Driver on Windows LOLDrivers vulnerable driver 1 Sigma rule names it

A known vulnerable driver

from LOLDrivers

T1068Exploitation for Privilege Escalation

Its entrieshttps://www.loldrivers.io/drivers/4c9a91ff-9284-49a7-899d-dfe85a112465/
https://www.loldrivers.io/drivers/e0e93453-1007-4799-ad02-9b461b7e0398/

3 known samples

3.3.0 · its entry

bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c

2.0.2 · its entry

347acba74fdcbeac671521739f8a34ec0e378caf716c31f55616f9f843e4d0d3

1.0.3 · its entry

bfbfcb7cae421739163e7630865009d3197f587265e9e5797142d93e1b72b191

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real TrueSight.sys?

file version info and known copies

ProductAdlice RootLaser, Adlice Software

DescriptionAdlice RootLaser

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names TrueSight.sys in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.