huntrule

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Flags Linux execution of TruffleHog when command lines reference common source platforms and cloud targets.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-09-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Linux process execution where the binary/image path ends with /trufflehog and the command line indicates secret-scanning targets such as Git/GitHub, Jira, Slack, Confluence, SharePoint, or cloud storage (s3, gcs). Attackers may use TruffleHog to discover exposed credentials or sensitive data across common code repositories and collaboration platforms. It relies on Linux process creation telemetry, matching the executable name and specific command-line substrings related to platform targets and optional verified results output.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
Suspicious Credential String Enumeration via findstr to Temp Directory
PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch
Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation
Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation
Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)
Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail
Suspicious GitHub CLI Auth Token Extraction via Command Line
Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)
Suspicious mdfind Search for Private Key Files on macOS (via process_creation)
Linux Process Execution of TruffleHog with Secret-Scanning Platforms
Pivot detection · T1552.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.