Windows TruffleSnout.exe Process Execution Detection

title: Windows TruffleSnout.exe Process Execution Detection
id: feba295b-e524-4547-90c9-50c188d7b0aa
status: test
description: This rule flags process creation events where the executable name is TruffleSnout.exe, including both the OriginalFileName and the image path ending with \TruffleSnout.exe. TruffleSnout is an AD discovery tool, and its execution can indicate attacker-driven reconnaissance and targeted enumeration. The detection relies on Windows process creation telemetry, specifically the process metadata fields for OriginalFileName and the image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md
  - https://github.com/dsnezhkov/TruffleSnout
  - https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-02-13
tags:
  - attack.discovery
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: TruffleSnout.exe
    - Image|endswith: \TruffleSnout.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 69ca006d-b9a9-47f5-80ff-ecd4d25d481a
    type: derived