Detection rules › Sigma

Potentially Suspicious JWT Token Search Via CLI

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems), kagebunsher
Source
github.com/SigmaHQ/sigma

Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: Potentially Suspicious JWT Token Search Via CLI
id: 6d3a3952-6530-44a3-8554-cf17c116c615
status: test
description: |
    Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
    JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
    Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
references:
    - https://mrd0x.com/stealing-tokens-from-office-applications/
    - https://www.scip.ch/en/?labs.20240523
author: Nasreddine Bencherchali (Nextron Systems), kagebunsher
date: 2022-10-25
modified: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1528
    - attack.t1552.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        CommandLine|contains:
            - 'find '
            - 'find.exe'
            - 'findstr'
            - 'select-string '
            - 'strings'
    selection_jwt_string:
        CommandLine|contains:
            - 'eyJ0eXAiOi' # {"typ":
            - 'eyJhbGciOi' # {"alg":
            - ' eyJ0eX'
            - ' "eyJ0eX"'
            - " 'eyJ0eX'"
            - ' eyJhbG'
            - ' "eyJhbG"'
            - " 'eyJhbG'"
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_tools

selection_tools:
    CommandLine|contains:
        - 'find '
        - 'find.exe'
        - 'findstr'
        - 'select-string '
        - 'strings'

Stage 2: selection_jwt_string

selection_jwt_string:
    CommandLine|contains:
        - 'eyJ0eXAiOi'
        - 'eyJhbGciOi'
        - ' eyJ0eX'
        - ' "eyJ0eX"'
        - " 'eyJ0eX'"
        - ' eyJhbG'
        - ' "eyJhbG"'
        - " 'eyJhbG'"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • "eyJ0eX"
  • "eyJhbG"
  • 'eyJ0eX'
  • 'eyJhbG'
  • eyJ0eX
  • eyJhbG
  • eyJ0eXAiOi
  • eyJhbGciOi
  • find
  • find.exe
  • findstr corpus 8 (sigma 6, splunk 2)
  • select-string
  • strings