MITRE ATT&CKsoftware (tool)
S9009 TruffleHog
- Domain
- enterprise
- Platforms
- IaaS, Linux, SaaS, Windows
- Aliases
- Trufflehog
- Version
- 1.0
- Created
- 2026-04-09
Description
TruffleHog is an open-source secrets-discovery tool that is used to search for credentials, API keys, and encryption keys across a variety of data sources and environments. TruffleHog has the ability to discover credentials and secrets stored in code repositories, git history, CI/CD pipelines, among other common storage locations to include filesystems and cloud storage buckets. TruffleHog was first released by its author in 2016.
Related
Uses · MITRE ATT&CK (16)
- T1213.005 Messaging Applications sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1059.009 Cloud API sub-technique
- T1619 Cloud Storage Object Discovery technique
- T1213.003 Code Repositories sub-technique
- T1580 Cloud Infrastructure Discovery technique
- T1078.004 Cloud Accounts sub-technique
- T1213.001 Confluence sub-technique
- T1213.002 Sharepoint sub-technique
- T1552.005 Cloud Instance Metadata API sub-technique
- T1552.001 Credentials In Files sub-technique
- T1528 Steal Application Access Token technique
- T1526 Cloud Service Discovery technique
- T1530 Data from Cloud Storage technique
- T1005 Data from Local System technique
- T1083 File and Directory Discovery technique
References
- https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/ Black Hills Information Security TruffleHog January 2024
- https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed Netskope Shai-Hulud November 2025
- https://github.com/trufflesecurity/trufflehog Github TruffleSecurity Trufflehog April 2025