TrueSightKiller is a C++-based tool designed to disable or terminate antivirus (AV) and endpoint detection and response (EDR) solutions on Windows systems, specifically those running Windows 23H2—even when advanced security features like Hypervisor-protected Code Integrity (HVCI), Windows Defender Application Control (WDAC), and Microsoft’s loldrivers blocklist are enabled.
How Does TrueSightKiller Work?
TrueSightKiller operates by leveraging a vulnerable Windows driver named truesight.sys (originally part of Adlice’s RogueKiller Antirootkit suite). The tool requires the truesight.sys driver to be present in the same directory as its executable. When launched, it presents a menu to specify a target process (by ID or name), then enters an infinite loop to monitor and interact with that process—typically to terminate it.
The main vulnerability exploited is arbitrary process termination: by issuing a specific IOCTL command (0x22E044) to the driver, TrueSightKiller can kill any process, including those protected by Windows security mechanisms (e.g., protected processes for AV/EDR software).
The tool can be stopped and its installed service deleted by sending a ctrl+c command.
Security Impact and Exploitation
TrueSightKiller is part of a broader class of attacks known as Bring Your Own Vulnerable Driver (BYOVD), where attackers install a legitimate but vulnerable driver to gain privileged access and disable security software. The truesight.sys driver, especially versions below 3.4.0 (notably 2.0.2), contains a flaw that allows attackers to terminate arbitrary processes, which has been widely exploited in the wild.
Attackers have generated thousands of unique variants of the driver (by modifying non-functional parts of the file while keeping its digital signature valid) to evade hash-based detection and blocklists.
TrueSightKiller and similar tools have been used in campaigns to facilitate the deployment of malware like Gh0st RAT and ransomware, often as part of multi-stage attacks that begin with phishing or malicious downloads.