Linux Process Execution of TruffleHog with Secret-Scanning Platforms
Flags Linux execution of TruffleHog when command lines reference common source platforms and cloud targets.
- Product
- linux
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-09-24
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Linux process execution where the binary/image path ends with /trufflehog and the command line indicates secret-scanning targets such as Git/GitHub, Jira, Slack, Confluence, SharePoint, or cloud storage (s3, gcs). Attackers may use TruffleHog to discover exposed credentials or sensitive data across common code repositories and collaboration platforms. It relies on Linux process creation telemetry, matching the executable name and specific command-line substrings related to platform targets and optional verified results output.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Process Execution of TruffleHog with Secret-Scanning Platforms
id: 6bdd99b5-0db6-49cf-90b5-a3e71153bb0e
related:
- id: 44030449-b0df-4c94-aae1-502359ab28ee
type: similar
- id: d7a650c4-226c-451e-948f-cc490db506aa
type: derived
status: experimental
description: This rule flags Linux process execution where the binary/image path ends with /trufflehog and the command line indicates secret-scanning targets such as Git/GitHub, Jira, Slack, Confluence, SharePoint, or cloud storage (s3, gcs). Attackers may use TruffleHog to discover exposed credentials or sensitive data across common code repositories and collaboration platforms. It relies on Linux process creation telemetry, matching the executable name and specific command-line substrings related to platform targets and optional verified results output.
references:
- https://github.com/trufflesecurity/trufflehog
- https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
tags:
- attack.discovery
- attack.credential-access
- attack.t1083
- attack.t1552.001
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /trufflehog
selection_cli_platform:
CommandLine|contains:
- " docker --image "
- " Git "
- " GitHub "
- " Jira "
- " Slack "
- " Confluence "
- " SharePoint "
- " s3 "
- " gcs "
selection_cli_verified:
CommandLine|contains: " --results=verified"
condition: selection_img or all of selection_cli_*
falsepositives:
- Legitimate use of TruffleHog by security teams or developers.
level: medium
license: DRL-1.1