PUA - AWS TruffleHog Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 29, 2025•6•0•78

Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.