PUA - AWS TruffleHog Execution

Status: experimental
Severity: medium
Log source: product aws, service cloudtrail
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.

Known false positives

Legitimate use of TruffleHog by security teams for credential scanning.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping `T1555` Credentials from Password Stores

Rule body

title: PUA - AWS TruffleHog Execution
id: a840e606-7c8c-4684-9bc1-eb6b6155127f
status: experimental
description: |
    Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
    It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
references:
    - https://github.com/trufflesecurity/trufflehog
    - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1555
    - attack.t1003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        userAgent: 'TruffleHog'
    condition: selection
falsepositives:
    - Legitimate use of TruffleHog by security teams for credential scanning.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    userAgent: 'TruffleHog'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`userAgent`	eq	`TruffleHog`	`field:"userAgent" kind:eq value:"TruffleHog"`