Malware

POORTRY

According to Mandiant, POORTRY is a malware written as a driver, signed with a Microsoft Windows Hardware Compatibility Authenticode signature. This malware has been observed being used by UNC3944.

Indicators of Compromise 1

Filename truesight.sys

MITRE ATT&CK TTPs 5

Process Injection

Defense Evasion

Exploitation for Privilege Escalation

Privilege Escalation

System Information Discovery

Defense Evasion

Disable or Modify Tools

Defense Evasion

Source Articles

The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers to Kill Security

Attackers are increasingly leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit legitimate, signed Windows kernel drivers and gain kernel-level privileges, enabling them to disable or bypass security software such as antivirus (AV) and endpoint detection and response (EDR) solutions. This method abuses flaws in trusted drivers like truesight.sys and those used by Microsoft Process Explorer, allowing attackers to terminate, suspend, or blind security processes. The technique has become widespread, with ready-made tools such as TrueSightKiller, GhostDriver, AuKill, and Poortry being integrated into ransomware-as-a-service (RaaS) offerings, making it a common component of modern ransomware attack chains.

security-com ·4w ago