Detectionhighexperimental
Script Interpreter Spawning Credential Scanner - Windows
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Tue Nov 250f60b28c-64dd-4e2c-9a63-5334d3e3a6e6windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection_parent:
ParentImage|endswith:
# Add more script interpreters as needed
- '\node.exe'
- '\bun.exe'
selection_child:
- Image|endswith:
- 'trufflehog.exe'
- 'gitleaks.exe'
- CommandLine|contains:
- 'trufflehog'
- 'gitleaks'
condition: all of selection_*False Positives
Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check.
References
MITRE ATT&CK
Rule Metadata
Rule ID
0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Status
experimental
Level
high
Type
Detection
Created
Tue Nov 25
Path
rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner.yml
Raw Tags
attack.credential-accessattack.t1552attack.collectionattack.executionattack.t1005attack.t1059.007