1200KM / sigma-rule
Potentially Suspicious JWT Token Search Via CLI — Sigma Rule
Sigma rule 6d3a3952-6530-44a3-8554-cf17c116c615. Potentially Suspicious JWT Token Search Via CLI — Sigma Rule. Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
Rule metadata and linked tags
Author: Nasreddine Bencherchali (Nextron Systems), kagebunsher. Source status: test; severity: medium. Source dates: 2022-10-25 / 2025-10-21.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: f2844be2ad1250f0c175cff649f0f7fe729a7a7d44b5718bda2a0ac72471dada
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Potentially Suspicious JWT Token Search Via CLI
id: 6d3a3952-6530-44a3-8554-cf17c116c615
status: test
description: |
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
references:
- https://mrd0x.com/stealing-tokens-from-office-applications/
- https://www.scip.ch/en/?labs.20240523
author: Nasreddine Bencherchali (Nextron Systems), kagebunsher
date: 2022-10-25
modified: 2025-10-21
tags:
- attack.credential-access
- attack.t1528
- attack.t1552.001
logsource:
category: process_creation
product: windows
detection:
selection_tools:
CommandLine|contains:
- 'find '
- 'find.exe'
- 'findstr'
- 'select-string '
- 'strings'
selection_jwt_string:
CommandLine|contains:
- 'eyJ0eXAiOi' # {"typ":
- 'eyJhbGciOi' # {"alg":
- ' eyJ0eX'
- ' "eyJ0eX"'
- " 'eyJ0eX'"
- ' eyJhbG'
- ' "eyJhbG"'
- " 'eyJhbG'"
condition: all of selection_*
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.