Suspicious TruffleHog Execution via NodeJS

[rule]
description = """
This rule detects the execution of TruffleHog from a JavaScript interpreter, TruffleHog is a tool used to search for
high-entropy strings and secrets in code repositories, which may indicate an attempt to access credentials. This tool
was abused by the Shai-Hulud worm to search for credentials in code repositories.
"""
id = "0f46cf1b-2c9f-4d56-8073-08b41bac72b4"
license = "Elastic License v2"
name = "Suspicious TruffleHog Execution via NodeJS"
os_list = ["linux", "windows"]
reference = [
    "https://www.elastic.co/blog/shai-hulud-worm-npm-supply-chain-compromise",
    "https://socket.dev/blog/shai-hulud-strikes-again-v2",
]
version = "1.0.1"

query = '''
process where event.action in ("start", "exec") and
 (
  (process.name in ("trufflehog", "trufflehog.exe") and process.args == "filesystem") or
  (process.args == "--json" and process.args == "filesystem")
  ) and
 (
  process.parent.name in ("node.exe", "node", "bun", "bun.exe") or
  process.working_directory like "*node_modules*"
 )
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1195"
name = "Supply Chain Compromise"
reference = "https://attack.mitre.org/techniques/T1195/"
[[threat.technique.subtechnique]]
id = "T1195.001"
name = "Compromise Software Dependencies and Development Tools"
reference = "https://attack.mitre.org/techniques/T1195/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "7.15.0"