PUA - AWS TruffleHog Execution

calendar Oct 29, 2025 · attack.credential-access attack.t1555 attack.t1003  ·
Share on: linkedin copy

Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.

Sigma rule (View on GitHub)

 1title: PUA - AWS TruffleHog Execution
 2id: a840e606-7c8c-4684-9bc1-eb6b6155127f
 3status: experimental
 4description: |
 5    Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
 6    It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.    
 7references:
 8    - https://github.com/trufflesecurity/trufflehog
 9    - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
10author: Swachchhanda Shrawan Poudel (Nextron Systems)
11date: 2025-10-21
12tags:
13    - attack.credential-access
14    - attack.t1555
15    - attack.t1003
16logsource:
17    product: aws
18    service: cloudtrail
19detection:
20    selection:
21        userAgent: 'TruffleHog'
22    condition: selection
23falsepositives:
24    - Legitimate use of TruffleHog by security teams for credential scanning.
25level: medium

References

Related rules

to-top