{"id":"d7a650c4-226c-451e-948f-cc490db506aa","title":"PUA - TruffleHog Execution - Linux","description":"Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\nWhile it is a legitimate tool, intended for use in CI pipelines and security assessments,\nIt was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-09-24","modified":"","tags":["attack.discovery","attack.credential-access","attack.t1083","attack.t1552.001"],"technique_ids":["T1083","T1552.001"],"logsource":{"category":"process_creation","product":"linux"},"falsepositives":["Legitimate use of TruffleHog by security teams or developers."],"references":["https://github.com/trufflesecurity/trufflehog","https://www.getsafety.com/blog-posts/shai-hulud-npm-attack"],"source_path":"rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml","source_sha256":"39a4e3fe60a35837c50b9770c83af7e9e7598d2f410106df165e48c4a0459fd5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - TruffleHog Execution - Linux\nid: d7a650c4-226c-451e-948f-cc490db506aa\nrelated:\n    - id: 44030449-b0df-4c94-aae1-502359ab28ee\n      type: similar\nstatus: experimental\ndescription: |\n    Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.\n    While it is a legitimate tool, intended for use in CI pipelines and security assessments,\n    It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.\nreferences:\n    - https://github.com/trufflesecurity/trufflehog\n    - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-09-24\ntags:\n    - attack.discovery\n    - attack.credential-access\n    - attack.t1083\n    - attack.t1552.001\nlogsource:\n    category: process_creation\n    product: linux\ndetection:\n    selection_img:\n        Image|endswith: '/trufflehog'\n    selection_cli_platform:\n        CommandLine|contains:\n            - ' docker --image '\n            - ' Git '\n            - ' GitHub '\n            - ' Jira '\n            - ' Slack '\n            - ' Confluence '\n            - ' SharePoint '\n            - ' s3 '\n            - ' gcs '\n    selection_cli_verified:\n        CommandLine|contains: ' --results=verified'\n    condition: selection_img or all of selection_cli_*\nfalsepositives:\n    - Legitimate use of TruffleHog by security teams or developers.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","page":"techniques/enterprise/T1083/"},{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","page":"techniques/enterprise/T1552.001/"}],"data_path":"data/detection-rules/d7a650c4-226c-451e-948f-cc490db506aa.json","kind":"sigma"}