CmdID

CmdID / Commands

trufflehog

Find and verify credentials in files, Git repositories, S3 buckets, and Docker images. tldr-pages

On several platforms 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Scan a Git repository for verified secrets

trufflehog git https://github.com/trufflesecurity/test_keys --only-verifiedIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan a GitHub organization for verified secrets

trufflehog github --org trufflesecurity --only-verifiedIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan a GitHub repository for verified keys and get JSON output

trufflehog git https://github.com/trufflesecurity/test_keys --only-verified --jsonIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan a GitHub repository along with its Issues and Pull Requests

trufflehog github --repo https://github.com/trufflesecurity/test_keys --issue-comments --pr-commentsIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan an S3 bucket for verified keys

trufflehog s3 --bucket bucket_name --only-verifiedIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan S3 buckets using IAM Roles

trufflehog s3 --role-arn iam_role_arnIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan individual files or directories

trufflehog filesystem path/to/file_or_directory1 path/to/file_or_directory2 ...Identify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

Scan a Docker image for verified secrets

trufflehog docker --image trufflesecurity/secrets --only-verifiedIdentify

Trips 1 Sigma rule: mediumPUA - TruffleHog Execution - Linux by Swachchhanda Shrawan Poudel (Nextron Systems)

What detects it

Sigma process creation rules that name trufflehog
highScript Interpreter Spawning Credential Scanner - LinuxSwachchhanda Shrawan Poudel (Nextron Systems)
mediumPUA - TruffleHog Execution - LinuxSwachchhanda Shrawan Poudel (Nextron Systems)