huntrule

Windows Process Creation: TruffleSnout.exe Execution

Detects execution of TruffleSnout.exe on Windows using process creation metadata.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-08-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies execution of the TruffleSnout.exe binary via process creation events by matching the OriginalFileName and the image path ending in \TruffleSnout.exe. Attackers may use this tool for iterative Active Directory discovery and low-noise enumeration to build targeting context. The rule relies on Windows process creation telemetry with process image/path and OriginalFileName fields.

Reporting behind it

Related detections9 linkedT1482 — drag to rearrange
Malicious AdFind Domain Trust Enumeration via Trustdmp
Suspicious Active Directory Reconnaissance Commands (via process_creation)
Suspicious Domain Trust Discovery via Nltest via Process Creation (via process_creation)
Suspicious Domain Controller Discovery via nltest dclist (via process_creation)
Suspicious SharpHound Group Enumeration LDAP Filter
Suspicious Nltest Domain Trust Enumeration via Command Line
Suspicious Discovery Command Spawned by Java Process
Uncommon Domain Trust Discovery via Nltest (via process_creation)
Suspicious SOAPHound Tautological LDAP Filter Enumeration
Windows Process Creation: TruffleSnout.exe Execution
Pivot detection · T1482 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.