TruffleHog
Software · ATTACK:enterprise:S9009
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9009",
"title": "TruffleHog",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9009",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--76f8a686-3157-481f-9af6-e8558883a8d6",
"external_id": "S9009",
"domain": "enterprise",
"created": "2026-04-09T19:12:38.917Z",
"modified": "2026-04-23T02:27:35.330Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Black Hills Information Security TruffleHog January 2024",
"url": "https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"
},
{
"source_name": "Netskope Shai-Hulud November 2025",
"url": "https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"
},
{
"source_name": "Github TruffleSecurity Trufflehog April 2025",
"url": "https://github.com/trufflesecurity/trufflehog"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06ee5784-6390-42ac-990a-0f90558ade30
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19f46d7e-22bd-4326-bc4e-b1b7335aee67
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1619
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2286eded-7606-46df-a469-c5240f21ed75
Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1059.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--752a6089-4d85-433e-994b-583c3f35c383
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1526
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76b8a9ab-e5e1-4809-bd5f-9235d9a24de9
Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1555.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e7151b1-8407-4cac-a843-f2605fb25377
Black Hills Information Security TruffleHog January 2024 · Netskope Shai-Hulud November 2025 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1580
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97e1ea2b-f8c8-4195-9bc2-9cad77368dca
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1552.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c12bad3-408b-473d-86b9-cf179edce3e2
Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1528
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aea68064-afb4-4748-9b7b-f10113f347ab
Black Hills Information Security TruffleHog January 2024ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7b24f8b-e156-407b-aa3d-3d2c18c84c2d
Black Hills Information Security TruffleHog January 2024 · Netskope Shai-Hulud November 2025 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cec55762-ea2f-424e-b87e-9bc574f331c2
Netskope Shai-Hulud November 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd4d5a0f-5b10-4062-a099-690eb57839fc
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e15c0df7-503b-4089-a333-c311ab782ea4
Black Hills Information Security TruffleHog January 2024 · Netskope Shai-Hulud November 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1530
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee1effa5-b256-4a6a-b7da-2d9066d7dccd
Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f92a119b-14ad-458d-95ad-a0dbc5e37e6e
Github TruffleSecurity Trufflehog April 2025ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1213.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff945dd5-cfe6-46a9-9aa3-bdb454e55447
Github TruffleSecurity Trufflehog April 2025