TruffleHog Execution Detection
Detects the execution of TruffleHog, a tool designed to search for secrets across various platforms such as Git, Jira, Slack, and SharePoint. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in campaigns like Shai-Hulud targeting npm packages to steal sensitive information. The rule triggers on the execution of 'trufflehog.exe' or when its command line arguments indicate searching specific platforms or verifying results.
Sigma
