Skip to content

Hide Navigation Hide TOC

Script Interpreter Spawning Credential Scanner - Linux (f0025a69-e1b7-4dda-a53c-db21fa2d4071)

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

Cluster A Galaxy A Cluster B Galaxy B Level
Unix Shell - T1059.004 (a9d4b653-6915-42af-98b2-5758c4ceee56) Attack Pattern Script Interpreter Spawning Credential Scanner - Linux (f0025a69-e1b7-4dda-a53c-db21fa2d4071) Sigma-Rules 1
Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517) Attack Pattern Script Interpreter Spawning Credential Scanner - Linux (f0025a69-e1b7-4dda-a53c-db21fa2d4071) Sigma-Rules 1
Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5) Attack Pattern Script Interpreter Spawning Credential Scanner - Linux (f0025a69-e1b7-4dda-a53c-db21fa2d4071) Sigma-Rules 1
Unix Shell - T1059.004 (a9d4b653-6915-42af-98b2-5758c4ceee56) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2