sigmamediumHunting

PUA - AWS TruffleHog Execution

Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.

MITRE ATT&CK

T1555 T1003

credential-access

Detection Query

selection:
  userAgent: TruffleHog
condition: selection

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Created

2025-10-21

Data Sources

awscloudtrail

Platforms

aws

References

Tags

attack.credential-accessattack.t1555attack.t1003

Raw Content

title: PUA - AWS TruffleHog Execution
id: a840e606-7c8c-4684-9bc1-eb6b6155127f
status: experimental
description: |
    Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
    It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
references:
    - https://github.com/trufflesecurity/trufflehog
    - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1555
    - attack.t1003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        userAgent: 'TruffleHog'
    condition: selection
falsepositives:
    - Legitimate use of TruffleHog by security teams for credential scanning.
level: medium