Potentially Suspicious JWT Token Search Via CLI

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), kagebunsher
Source: github.com/SigmaHQ/sigma

Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1528` Steal Application Access Token `T1552.001` Unsecured Credentials: Credentials In Files

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potentially Suspicious JWT Token Search Via CLI
id: 6d3a3952-6530-44a3-8554-cf17c116c615
status: test
description: |
    Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
    JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
    Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
references:
    - https://mrd0x.com/stealing-tokens-from-office-applications/
    - https://www.scip.ch/en/?labs.20240523
author: Nasreddine Bencherchali (Nextron Systems), kagebunsher
date: 2022-10-25
modified: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1528
    - attack.t1552.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        CommandLine|contains:
            - 'find '
            - 'find.exe'
            - 'findstr'
            - 'select-string '
            - 'strings'
    selection_jwt_string:
        CommandLine|contains:
            - 'eyJ0eXAiOi' # {"typ":
            - 'eyJhbGciOi' # {"alg":
            - ' eyJ0eX'
            - ' "eyJ0eX"'
            - " 'eyJ0eX'"
            - ' eyJhbG'
            - ' "eyJhbG"'
            - " 'eyJhbG'"
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_tools`

selection_tools:
    CommandLine|contains:
        - 'find '
        - 'find.exe'
        - 'findstr'
        - 'select-string '
        - 'strings'

Stage 2: `selection_jwt_string`

selection_jwt_string:
    CommandLine|contains:
        - 'eyJ0eXAiOi'
        - 'eyJhbGciOi'
        - ' eyJ0eX'
        - ' "eyJ0eX"'
        - " 'eyJ0eX'"
        - ' eyJhbG'
        - ' "eyJhbG"'
        - " 'eyJhbG'"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`"eyJ0eX"` `"eyJhbG"` `'eyJ0eX'` `'eyJhbG'` `eyJ0eX` `eyJhbG` `eyJ0eXAiOi` `eyJhbGciOi` `find` `find.exe` `findstr` corpus 8 (sigma 6, splunk 2) `select-string` `strings`	`field:"CommandLine" kind:match`