huntrule

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Flags Linux execution of TruffleHog when command lines reference common source platforms and cloud targets.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-09-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process execution where the binary/image path ends with /trufflehog and the command line indicates secret-scanning targets such as Git/GitHub, Jira, Slack, Confluence, SharePoint, or cloud storage (s3, gcs). Attackers may use TruffleHog to discover exposed credentials or sensitive data across common code repositories and collaboration platforms. It relies on Linux process creation telemetry, matching the executable name and specific command-line substrings related to platform targets and optional verified results output.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch
Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup
Suspicious Access to Cloud and Database Credential Files via Process
Suspicious Credential Exfiltration to webhook.site (via dns_query)
Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)
Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)
Possible Stolen AWS Credential Validation via STS GetCallerIdentity
Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)
Malicious Winlogon Automatic Logon Persistence via Registry AutoAdminLogon (via process_creation)
Linux Process Execution of TruffleHog with Secret-Scanning Platforms
Pivot detection · T1552.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.