Rule Info
Name
PUA - TruffleHog Execution - Linux
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Date
2025-09-24 00:00:00
Modified
None
Id
d7a650c4-226c-451e-948f-cc490db506aa
Tags
attack.discovery attack.credential-access attack.t1083 attack.t1552.001
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR