Suspicious PUA - AWS TruffleHog Execution (via cloudtrail)

title: Suspicious PUA - AWS TruffleHog Execution (via cloudtrail)
id: c43bf3a6-3fc6-5d9f-84cc-d81c47903a47
status: stable
description: This rule detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the use is authorized by security teams or potentially malicious.
references:
    - https://attack.mitre.org/techniques/T1003/
    - https://attack.mitre.org/techniques/T1555/
    - https://github.com/trufflesecurity/trufflehog
    - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
author: Huntrule Team
date: 2026-05-15
tags:
    - attack.credential-access
    - attack.t1555
    - attack.t1003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        userAgent: 'TruffleHog'
    condition: selection
falsepositives:
    - Unknown
level: medium