Linux Process Execution of TruffleHog with Secret-Search Platform Arguments

Flags Linux execution of TruffleHog when command lines reference common source platforms and cloud targets.

FreeUnreviewedSigmamediumv1

linux-process-execution-of-trufflehog-with-secret-search-platform-arguments-d7a650c4

title: Linux Process Execution of TruffleHog with Secret-Search Platform Arguments
id: 6bdd99b5-0db6-49cf-90b5-a3e71153bb0e
related:
  - id: 44030449-b0df-4c94-aae1-502359ab28ee
    type: similar
  - id: d7a650c4-226c-451e-948f-cc490db506aa
    type: derived
status: experimental
description: This rule flags execution of the TruffleHog binary on Linux, including command lines referencing multiple supported secret-search targets such as GitHub, Jira, Slack, Confluence, SharePoint, S3, and GCS. Although TruffleHog is a legitimate security tool, attackers may use it to enumerate and extract sensitive information from development platforms and cloud storage. The detection relies on Linux process creation telemetry, matching the executed image path and specific substrings in the command line, including an optional indicator for verified results.
references:
  - https://github.com/trufflesecurity/trufflehog
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1083
  - attack.t1552.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /trufflehog
  selection_cli_platform:
    CommandLine|contains:
      - " docker --image "
      - " Git "
      - " GitHub "
      - " Jira "
      - " Slack "
      - " Confluence "
      - " SharePoint "
      - " s3 "
      - " gcs "
  selection_cli_verified:
    CommandLine|contains: " --results=verified"
  condition: selection_img or all of selection_cli_*
falsepositives:
  - Legitimate use of TruffleHog by security teams or developers.
level: medium
license: DRL-1.1

What it detects

This rule flags execution of the TruffleHog binary on Linux, including command lines referencing multiple supported secret-search targets such as GitHub, Jira, Slack, Confluence, SharePoint, S3, and GCS. Although TruffleHog is a legitimate security tool, attackers may use it to enumerate and extract sensitive information from development platforms and cloud storage. The detection relies on Linux process creation telemetry, matching the executed image path and specific substrings in the command line, including an optional indicator for verified results.

Known false positives

Legitimate use of TruffleHog by security teams or developers.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.