HackTool - TruffleSnout Execution

testhigh
log source: windows · process_creationauthor frack113date 2022-08-20
01

description

What this is, in brief.

Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

02

tags

attack.discoveryattack.t1482
03

rule source (YAML)

title: HackTool - TruffleSnout Execution
id: 69ca006d-b9a9-47f5-80ff-ecd4d25d481a
status: test
description: Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md
    - https://github.com/dsnezhkov/TruffleSnout
    - https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
author: frack113
date: 2022-08-20
modified: 2023-02-13
tags:
    - attack.discovery
    - attack.t1482
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName: 'TruffleSnout.exe'
        - Image|endswith: '\TruffleSnout.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.