TruffleHog Activity in Cloud Environments

Lacey Cochrane@NullVectorX

•updated Mar 31, 2026•12•0•280

This rule detects activity associated with TruffleHog, an open-source tool used for finding credentials and sensitive data, within cloud audit logs. It specifically looks for the 'trufflehog' string in the user_agent field, indicating that the tool was used to interact with cloud resources.