YARA · SEKOIA.IO Community

SEKOIA_Truesightkiller_Avkiller_Strings

TrueSightKiller based on string

GenericSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X

Author: Sekoia.io
Date: 2024-10-29
Modified: 2024-12-19
Score / Quality: 75 / 78

What this rule detects

TrueSightKiller based on string

Targets: Windows PE.

It defines 24 patterns (24 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

truesightkiller-avkiller-strings.yarDetection Rule License 1.1

rule SEKOIA_Truesightkiller_Avkiller_Strings : FILE
{
	meta:
		description = "TrueSightKiller based on string"
		author = "Sekoia.io"
		id = "8f249ac4-5181-4169-9eb2-7d73ec4fd68d"
		date = "2024-10-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/truesightkiller_avkiller_strings.yar#L1-L45"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "891202963430a4b1dea2dc5b9af01dc5"
		hash = "367af202029bf51fc347a8f414fa2a5c"
		hash = "64439836d69084b129c2dc4264176149"
		hash = "6e69b890b1c228fa4225776b185b5af7"
		hash = "daaf7bdf1e7fd882c0bfb89450ec0ab2"
		hash = "dcf36765ed9386c169eb2695d26f6a6f"
		logic_hash = "829d144023569f332a27b7f2344d2da7be59ae5044a13c299c5da50d896288ed"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "[+] Process PID: " wide
		$ = "[-] OpenSCManager failed" wide
		$ = "[+] Creating service: truesight" wide
		$ = "[+] Full path: " wide
		$ = "[-] Error getting current directory." wide
		$ = "[-] CreateService failed" wide
		$ = "[!] Service is already running" wide
		$ = "[-] QueryServiceStatus failed" wide
		$ = "[-] StartService failed" wide
		$ = "[+] Driver loaded successfully!" wide
		$ = "[-] OpenService failed" wide
		$ = "[-] ControlService failed" wide
		$ = "[-] DeleteService failed" wide
		$ = "Welcome to EDR/AV Killer using truesight driver!" wide
		$ = "This is a PoC, use it at your own risk!" wide
		$ = "[-] Failed to set CTRL+C handler. Exiting..." wide
		$ = "ntdll.dll" wide
		$ = "\\\\.\\TrueSight" wide
		$ = "[-] CreateFileA failed" wide
		$ = " not running" wide
		$ = "[-] Process name: " wide
		$ = "[+] Terminating PID: " wide
		$ = "[-] DevicesIoControl failed" wide
		$ = "[!] Stoping and Deleting trueSight Service!" wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 1MB and filesize > 20KB and 20 of them
}

Strings (24 patterns)

Identifier	Type	Value	Modifiers
$	text	"[+] Process PID: "	wide
$	text	"[-] OpenSCManager failed"	wide
$	text	"[+] Creating service: truesight"	wide
$	text	"[+] Full path: "	wide
$	text	"[-] Error getting current directory."	wide
$	text	"[-] CreateService failed"	wide
$	text	"[!] Service is already running"	wide
$	text	"[-] QueryServiceStatus failed"	wide
$	text	"[-] StartService failed"	wide
$	text	"[+] Driver loaded successfully!"	wide
$	text	"[-] OpenService failed"	wide
$	text	"[-] ControlService failed"	wide
$	text	"[-] DeleteService failed"	wide
$	text	"Welcome to EDR/AV Killer using truesight driver!"	wide
$	text	"This is a PoC, use it at your own risk!"	wide
$	text	"[-] Failed to set CTRL+C handler. Exiting..."	wide
$	text	"ntdll.dll"	wide
$	text	"\\\\.\\TrueSight"	wide
$	text	"[-] CreateFileA failed"	wide
$	text	" not running"	wide
$	text	"[-] Process name: "	wide
$	text	"[+] Terminating PID: "	wide
$	text	"[-] DevicesIoControl failed"	wide
$	text	"[!] Stoping and Deleting trueSight Service!"	wide

Condition

uint16be( 0 ) == 0x4d5a and filesize < 1MB and filesize > 20KB and 20 of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 1MB (a cheap guard that skips large files).
The file must be larger than 20KB.
At least 20 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

891202963430a4b1dea2dc5b9af01dc5
367af202029bf51fc347a8f414fa2a5c
64439836d69084b129c2dc4264176149
6e69b890b1c228fa4225776b185b5af7
daaf7bdf1e7fd882c0bfb89450ec0ab2
dcf36765ed9386c169eb2695d26f6a6f

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 8f249ac4-5181-4169-9eb2-7d73ec4fd68d

Metadata

version	1.0
classification	TLP:CLEAR

Tags:FILE

SEKOIA_Apt_Gobrat_2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
SEKOIA_Apt_Icepeony_Icecache
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Icepeony_Iceevent
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Kimsuky_Fpspy
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Klogexe
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-27
SEKOIA_Apt_Kimsuky_Powershell
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-23
SEKOIA_Apt_Kimsuky_Powershell_Dropper_Strings
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-06-11
SEKOIA_Apt_Kimsuky_Toddlershark_Obfuscated
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-03-06