Malware

AuKill

Also known as: SophosKill

According to Sophos, the AuKill tool abuses an outdated version of the driver used by version 16.32 of the Microsoft utility, Process Explorer, to disable EDR processes before deploying either a backdoor or ransomware on the target system.

Indicators of Compromise 1

Filename truesight.sys

MITRE ATT&CK TTPs 5

T1055
Process Injection
Defense Evasion
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1082
System Information Discovery
Discovery
 T1497.001
System Checks
Defense Evasion
 T1562.001
Disable or Modify Tools
Defense Evasion

Source Articles

The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security
Attackers are increasingly leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit legitimate, signed Windows kernel drivers and gain kernel-level privileges, enabling them to disable or bypass security software such as antivirus (AV) and endpoint detection and response (EDR) solutions. This method abuses flaws in trusted drivers like truesight.sys and those used by Microsoft Process Explorer, allowing attackers to terminate, suspend, or blind security processes. The technique has become widespread, with ready-made tools such as TrueSightKiller, GhostDriver, AuKill, and Poortry being integrated into ransomware-as-a-service (RaaS) offerings, making it a common component of modern ransomware attack chains.
security-com ·4w ago