Query: rule covering Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog,
Matching passage: Sigma rule: Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog,. Logsource: linux / process_creation. Rule: title: Script Interpreter Spawning Credential Scanner - Linux id: f0025a69-e1b7-4dda-a53c-db21fa2d4071 related: - id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 type: similar status: experimental description: 'Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign. ' references: - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-25 tags: - attack.credential-access - attack.t1552 - attack.execution - attack.collection - attack.t1005 - attack.t1059.004 logsource: category: process_creation product: linux detection: selection_parent: ParentImage|endswith: - /node - /bun selection_child: - Image|endswith: - /trufflehog - /gitleaks - CommandLine|contains: - trufflehog - gitleaks condition: all of selection_* falsepositives: - Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check. level: high
Near-miss passage: Sigma rule: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command. Logsource: windows / process_creation. Rule: title: Obfuscated IP Download Activity id: cb5a2333-56cf-4562-8fcb-22ba1bca728d status: test description: Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command references: - https://h.43z.one/ipconverter/ - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608 - https://twitter.com/fr0s7_/status/1712780207105404948 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems) date: 2022-08-03 modified: 2026-03-16 tags: - attack.discovery logsource: category: process_creation product: windows detection: selection_command: CommandLine|contains: - Invoke-WebRequest - 'iwr ' - Invoke-RestMethod - 'irm ' - 'wget ' - 'curl ' - DownloadFile - DownloadString selection_ip_1: CommandLine|contains: - ' 0x' - //0x - .0x - .00x selection_ip_2: CommandLine|contains|all: - http://% - '%2e' selection_ip_3: - CommandLine|re: https?://[0-9]{1,3}\.[0-9]{1,3}\.0[0-9]{3,4} - CommandLine|re: https?://[0-9]{1,3}\.0[0-9]{3,7} - CommandLine|re: https?://0[0-9]{3,11} - CommandLine|re: https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11} - CommandLine|re: https?://0[0-9]{1,11} - CommandLine|re: ' [0-7]{7,13}' filter_main_valid_ip: CommandLine|re: https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4} condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_* falsepositives: - Unknown level: medium