Windows Process Creation: TruffleSnout.exe Execution

Detects execution of TruffleSnout.exe on Windows using process creation metadata.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-08-20
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1482Domain Trust Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies execution of the TruffleSnout.exe binary via process creation events by matching the OriginalFileName and the image path ending in \TruffleSnout.exe. Attackers may use this tool for iterative Active Directory discovery and low-noise enumeration to build targeting context. The rule relies on Windows process creation telemetry with process image/path and OriginalFileName fields.

Reporting behind it

Related detections9 linkedT1482 — drag to rearrange

Suspicious Discovery Command Spawned by Java Process

Uncommon Domain Trust Discovery via Nltest (via process_creation)

Suspicious SOAPHound Tautological LDAP Filter Enumeration

Suspicious Domain Trust Enumeration via Nltest

Suspicious Domain Controller and Trust Enumeration via Nltest

Suspicious Domain Trust Discovery via Nltest

Suspicious Active Directory Forest PowerShell Class Called from a Non Administrative Host (via powershell)

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot

Windows Process Creation: TruffleSnout.exe Execution

Pivot detection · T1482 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-trufflesnout-exe-process-execution-detection-69ca006d

title: "Windows Process Creation: TruffleSnout.exe Execution"
id: feba295b-e524-4547-90c9-50c188d7b0aa
status: test
description: Identifies execution of the TruffleSnout.exe binary via process creation events by matching the OriginalFileName and the image path ending in \TruffleSnout.exe. Attackers may use this tool for iterative Active Directory discovery and low-noise enumeration to build targeting context. The rule relies on Windows process creation telemetry with process image/path and OriginalFileName fields.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md
  - https://github.com/dsnezhkov/TruffleSnout
  - https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml
author: frack113, Huntrule Team
date: 2022-08-20
modified: 2023-02-13
tags:
  - attack.discovery
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: TruffleSnout.exe
    - Image|endswith: \TruffleSnout.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 69ca006d-b9a9-47f5-80ff-ecd4d25d481a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL