HackTool - TruffleSnout Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•16

Detects the execution of 'TruffleSnout.exe', a tool designed for iterative Active Directory discovery, situational awareness, and targeted low-noise enumeration. This rule identifies the tool by its original filename or by the executable's image path ending with 'TruffleSnout.exe'.