Skip to content

Hide Navigation Hide TOC

Script Interpreter Spawning Credential Scanner - Windows (0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6)

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

Cluster A Galaxy A Cluster B Galaxy B Level
Script Interpreter Spawning Credential Scanner - Windows (0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6) Sigma-Rules Data from Local System - T1005 (3c4a2599-71ee-4405-ba1e-0e28414b4bc5) Attack Pattern 1
Script Interpreter Spawning Credential Scanner - Windows (0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6) Sigma-Rules JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern 1
Script Interpreter Spawning Credential Scanner - Windows (0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6) Sigma-Rules Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517) Attack Pattern 1
JavaScript - T1059.007 (0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2