huntrule

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Flags Windows execution of trufflehog.exe, especially when targeting common code and collaboration platforms and using --results=verified.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-09-24
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access → Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows processes where the executable path ends with trufflehog.exe, including command lines that reference multiple supported platforms (e.g., Git, GitHub, Jira, Slack, SharePoint) and cloud/storage targets (s3, gcs). It also matches executions that include the flag --results=verified, indicating focused secret verification behavior. Although TruffleHog can be used legitimately for security assessments and CI workflows, attackers may leverage it to discover and validate exposed credentials or secrets across repositories and services.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
Suspicious Credential String Enumeration via findstr to Temp Directory
Linux Process Execution of TruffleHog with Secret-Scanning Platforms
Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation
Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation
Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)
Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail
Suspicious GitHub CLI Auth Token Extraction via Command Line
Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)
Suspicious mdfind Search for Private Key Files on macOS (via process_creation)
PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch
Pivot detection · T1552.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.