HackTool - TruffleSnout Execution

Title: HackTool - TruffleSnout Execution
Status: test
Description:Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1482/T1482.md
  -https://github.com/dsnezhkov/TruffleSnout
  -https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
Author: frack113
Date: 2022-08-20
modified:2023-02-13
Tags:

• -'attack.discovery'
• -'attack.t1482'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
OriginalFileName:'TruffleSnout.exe' Image|endswith:'\TruffleSnout.exe'   condition:selection
Falsepositives:
  -Unknown
Level: high