BYOVD kernel driver install/reference: TrueSight/rentdrv2

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•4

Detects the presence or installation of 'truesight.sys' or 'rentdrv2.sys' drivers, which are associated with malicious activity. The rule also triggers when system utilities like sc.exe or services.exe are used to set services related to these names to a 'demand' start type, indicating potential persistence or malicious driver loading.