PUA - AWS CloudTrail execution of TruffleHog via TruffleHog user agent

Flags AWS CloudTrail events with user agent "TruffleHog" to surface potential secret-scanning or credential-harvesting activity.

FreeUnreviewedSigmamediumv1

pua-aws-cloudtrail-execution-of-trufflehog-via-trufflehog-user-agent-a840e606

title: PUA - AWS CloudTrail execution of TruffleHog via TruffleHog user agent
id: 78140e26-9964-4ce0-87a0-ebd7eb5485bc
status: experimental
description: This rule flags AWS CloudTrail events where the user agent is exactly "TruffleHog", indicating the tool’s activity within an AWS environment. Attackers may use secret-scanning tools to find exposed credentials or sensitive information during initial access and credential harvesting. The detection relies on CloudTrail telemetry containing the userAgent field matching TruffleHog and should be investigated to confirm authorized security scanning versus potential misuse.
references:
  - https://github.com/trufflesecurity/trufflehog
  - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-21
tags:
  - attack.credential-access
  - attack.t1555
  - attack.t1003
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userAgent: TruffleHog
  condition: selection
falsepositives:
  - Legitimate use of TruffleHog by security teams for credential scanning.
level: medium
license: DRL-1.1
related:
  - id: a840e606-7c8c-4684-9bc1-eb6b6155127f
    type: derived

What it detects

This rule flags AWS CloudTrail events where the user agent is exactly "TruffleHog", indicating the tool’s activity within an AWS environment. Attackers may use secret-scanning tools to find exposed credentials or sensitive information during initial access and credential harvesting. The detection relies on CloudTrail telemetry containing the userAgent field matching TruffleHog and should be investigated to confirm authorized security scanning versus potential misuse.

Known false positives

Legitimate use of TruffleHog by security teams for credential scanning.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.