PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Flags Windows execution of trufflehog.exe, especially when targeting common code and collaboration platforms and using --results=verified.

FreeUnreviewedSigmamediumv1

pua-trufflehog-execution-on-windows-via-trufflehog-exe-process-launch-44030449

title: "PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch"
id: 5965a290-ca5e-4ceb-9a4d-e1f5521b0492
related:
  - id: d7a650c4-226c-451e-948f-cc490db506aa
    type: similar
  - id: 44030449-b0df-4c94-aae1-502359ab28ee
    type: derived
status: experimental
description: This rule identifies Windows processes where the executable path ends with trufflehog.exe, including command lines that reference multiple supported platforms (e.g., Git, GitHub, Jira, Slack, SharePoint) and cloud/storage targets (s3, gcs). It also matches executions that include the flag --results=verified, indicating focused secret verification behavior. Although TruffleHog can be used legitimately for security assessments and CI workflows, attackers may leverage it to discover and validate exposed credentials or secrets across repositories and services.
references:
  - https://github.com/trufflesecurity/trufflehog
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_trufflehog.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-09-24
tags:
  - attack.discovery
  - attack.credential-access
  - attack.t1083
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \trufflehog.exe
  selection_cli_platform:
    CommandLine|contains:
      - " docker --image "
      - " Git "
      - " GitHub "
      - " Jira "
      - " Slack "
      - " Confluence "
      - " SharePoint "
      - " s3 "
      - " gcs "
  selection_cli_verified:
    CommandLine|contains: " --results=verified"
  condition: selection_img or all of selection_cli_*
falsepositives:
  - Legitimate use of TruffleHog by security teams or developers.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_trufflehog/info.yml
license: DRL-1.1

What it detects

This rule identifies Windows processes where the executable path ends with trufflehog.exe, including command lines that reference multiple supported platforms (e.g., Git, GitHub, Jira, Slack, SharePoint) and cloud/storage targets (s3, gcs). It also matches executions that include the flag --results=verified, indicating focused secret verification behavior. Although TruffleHog can be used legitimately for security assessments and CI workflows, attackers may leverage it to discover and validate exposed credentials or secrets across repositories and services.

Known false positives

Legitimate use of TruffleHog by security teams or developers.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.