PUA - TruffleHog Execution

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

2025-09-24 00:00:00

None

44030449-b0df-4c94-aae1-502359ab28ee

attack.discovery attack.credential-access attack.t1083 attack.t1552.001

Community Rule

RobertN87

Merge PR #5714 from @RobertN87 - Add missing MITRE tactics for 2 rules

2025-10-21

Swachchhanda Shrawan Poudel

Merge PR #5658 from @swachchhanda000 - feat: shai hulud worm targeting npm supply chain attack

2025-10-19