SilverFox TrueSightKiller Driver Load for EDR Defense Impairment
This rule detects the deployment and activity associated with the TrueSightKiller rootkit, potentially used by threat actors like SilverFox. It identifies several key indicators: the loading of 'truesight.sys' from non-standard directories, the creation of a staging file named 'ranchserv.jpg' in the Windows Temp directory by non-system processes, the presence of the 'truesight.sys' driver based on its known SHA256 hash, and the termination of security products shortly after the creation of TrueSightKiller-related artifacts.
Microsoft Sentinel (KQL)
