Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner
Flags node.exe or bun.exe spawning trufflehog/gitleaks to perform secret or credential scanning.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-25
- Updated
- 2026-07-30
ATT&CK techniques
Execution → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation on Windows where a script interpreter (node.exe or bun.exe) spawns a known credential scanning tool (trufflehog.exe or gitleaks.exe), or a child command line referencing those tools. This behavior is commonly associated with attempts to discover and extract sensitive information from code repositories or exposed environments. Detection relies on Windows process creation telemetry including parent image, child image, and command line content.
Reporting behind it
- github.comhttps://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js
- stepsecurity.iohttps://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
- endorlabs.comhttps://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime
- semgrep.devhttps://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Script Interpreter Launching trufflehog or gitleaks Credential Scanner
id: 2ced26ca-5436-4f9e-81ea-8f3882db546c
related:
- id: f0025a69-e1b7-4dda-a53c-db21fa2d4071
type: similar
- id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
type: derived
status: experimental
description: This rule identifies process creation on Windows where a script interpreter (node.exe or bun.exe) spawns a known credential scanning tool (trufflehog.exe or gitleaks.exe), or a child command line referencing those tools. This behavior is commonly associated with attempts to discover and extract sensitive information from code repositories or exposed environments. Detection relies on Windows process creation telemetry including parent image, child image, and command line content.
references:
- https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js
- https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
- https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime
- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-25
tags:
- attack.credential-access
- attack.t1552
- attack.collection
- attack.execution
- attack.t1005
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \node.exe
- \bun.exe
selection_child:
- Image|endswith:
- trufflehog.exe
- gitleaks.exe
- CommandLine|contains:
- trufflehog
- gitleaks
condition: all of selection_*
falsepositives:
- Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner/info.yml
license: DRL-1.1