Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)

ATT&CK techniques

Execution → Collection

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552Unsecured Credentials
Discovery
Lateral Movement
Collection
- T1005Data from Local System
C2
Exfiltration
Impact

What it detects

This rule matches process creation on Linux where a script interpreter (parent executable ending in /node or /bun) spawns a process image ending in /trufflehog or /gitleaks, or where the spawned command line contains those tool names. Secret-recovery tooling is often used by attackers to enumerate exposed credentials and tokens within repositories and environments, so interpreter-driven execution can indicate automated reconnaissance. It relies on process creation telemetry that includes parent process image and child process image/command line for accurate string and path matching.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner

Malicious SD-WAN Compromise Credential Theft via loot_run.sh

Suspicious Bad Apples Reverse Shell via socat pty

Suspicious Axios NPM macOS Persistence Masquerading as Apple Service

Malicious Shell Payload Piped from curl to zsh

Possible Bitbucket Pre-Auth RCE via git archive exec Null-Byte Injection (CVE-2022-36804) (via webserver)

Possible SSRF via VMware Workspace One Access instanceHealth CVE-2021-22056

Suspicious BoryptGrab Infostealer Staging Directory (via file_event)

Malicious TeamTNT Docker Gatling Gun Initialization Script (via process_creation)

Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)

Pivot detection · T1059.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-script-interpreter-spawns-trufflehog-or-gitleaks-f0025a69

title: Linux Script Interpreters Spawning Credential Scanners (trufflehog, gitleaks)
id: ae987e06-77df-4286-988f-b62e738a7295
related:
  - id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
    type: similar
  - id: f0025a69-e1b7-4dda-a53c-db21fa2d4071
    type: derived
status: experimental
description: This rule matches process creation on Linux where a script interpreter (parent executable ending in /node or /bun) spawns a process image ending in /trufflehog or /gitleaks, or where the spawned command line contains those tool names. Secret-recovery tooling is often used by attackers to enumerate exposed credentials and tokens within repositories and environments, so interpreter-driven execution can indicate automated reconnaissance. It relies on process creation telemetry that includes parent process image and child process image/command line for accurate string and path matching.
references:
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js
  - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
  - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_script_interpretor_spawn_credential_scanner.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
  - attack.credential-access
  - attack.t1552
  - attack.execution
  - attack.collection
  - attack.t1005
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - /node
      - /bun
  selection_child:
    - Image|endswith:
        - /trufflehog
        - /gitleaks
    - CommandLine|contains:
        - trufflehog
        - gitleaks
  condition: all of selection_*
falsepositives:
  - Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check.
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL