From 1ef5706009a558324dc4022ae5f28f3c26899873 Mon Sep 17 00:00:00 2001
From: Lahu Khatal <89455554+lahukhatal7@users.noreply.github.com>
Date: Wed, 24 Sep 2025 22:54:56 +0530
Subject: [PATCH] Create launch_of_trufflehog.md

REO-10834
---
 .../Forge Web Credentials/launch_of_trufflehog.md    | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 Worm/NPM/Forge Web Credentials/launch_of_trufflehog.md

diff --git a/Worm/NPM/Forge Web Credentials/launch_of_trufflehog.md b/Worm/NPM/Forge Web Credentials/launch_of_trufflehog.md
new file mode 100644
index 0000000..21cb1d4
--- /dev/null
+++ b/Worm/NPM/Forge Web Credentials/launch_of_trufflehog.md	
@@ -0,0 +1,12 @@
+# Trufflehog
+
+Use this query to look for Trufflehog tool in the environment.
+
+## EDR CDM [Cloud Console queries]
+
+### Search for Trufflehog tool launch
+
+```
+Device OS Type:100-Windows AND Event Type Id: 8001-Process Activity AND Disposition:1 AND Process Name:trufflehog.exe
+```
+