Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner

Flags node.exe or bun.exe spawning trufflehog/gitleaks to perform secret or credential scanning.

FreeUnreviewedSigmahighv1

windows-script-interpreter-launching-trufflehog-or-gitleaks-credential-scanner-0f60b28c

title: Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner
id: 2ced26ca-5436-4f9e-81ea-8f3882db546c
related:
  - id: f0025a69-e1b7-4dda-a53c-db21fa2d4071
    type: similar
  - id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
    type: derived
status: experimental
description: This rule identifies process creation on Windows where a script interpreter (node.exe or bun.exe) spawns a known credential scanning tool (trufflehog.exe or gitleaks.exe), or a child command line referencing those tools. This behavior is commonly associated with attempts to discover and extract sensitive information from code repositories or exposed environments. Detection relies on Windows process creation telemetry including parent image, child image, and command line content.
references:
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js
  - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
  - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
  - attack.credential-access
  - attack.t1552
  - attack.collection
  - attack.execution
  - attack.t1005
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \node.exe
      - \bun.exe
  selection_child:
    - Image|endswith:
        - trufflehog.exe
        - gitleaks.exe
    - CommandLine|contains:
        - trufflehog
        - gitleaks
  condition: all of selection_*
falsepositives:
  - Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner/info.yml
license: DRL-1.1

What it detects

This rule identifies process creation on Windows where a script interpreter (node.exe or bun.exe) spawns a known credential scanning tool (trufflehog.exe or gitleaks.exe), or a child command line referencing those tools. This behavior is commonly associated with attempts to discover and extract sensitive information from code repositories or exposed environments. Detection relies on Windows process creation telemetry including parent image, child image, and command line content.

Known false positives

Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.