Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

HighΣSigmaHQ

Script Interpreter Spawning Credential Scanner - Linux

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

ATT&CK coverage

Execution

T1059Command and Scripting Interpreter
- T1059.004Unix Shell 187 detections cover this technique

Credential Access

T1552Unsecured Credentials 110 detections cover this technique

Collection

T1005Data from Local System 52 detections cover this technique

Detection requirements

Log source product: linux
Log source category: process_creation

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Swachchhanda Shrawan Poudel (Nextron Systems)
Licence: Detection Rule License 1.1Read the licence
Published: Aug 26, 2026
Version: 1