Potentially Suspicious JWT Token Search Through CLI (via process_creation)

title: Potentially Suspicious JWT Token Search Through CLI (via process_creation)
id: 203e70ae-6bd6-51b8-80c2-57cc8c792352
status: stable
description: This rule detects potentially anomalous search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are frequently used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
references:
    - https://attack.mitre.org/techniques/T1552/001/
    - https://attack.mitre.org/techniques/T1528/
    - https://mrd0x.com/stealing-tokens-from-office-applications/
    - https://www.scip.ch/en/?labs.20240523
author: Huntrule Team
date: 2026-07-23
tags:
    - attack.credential-access
    - attack.t1528
    - attack.t1552.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        CommandLine|contains:
            - 'find '
            - 'find.exe'
            - 'findstr'
            - 'select-string '
            - 'strings'
    selection_jwt_string:
        CommandLine|contains:
            - 'eyJ0eXAiOi'
            - 'eyJhbGciOi'
            - ' eyJ0eX'
            - ' "eyJ0eX"'
            - " 'eyJ0eX'"
            - ' eyJhbG'
            - ' "eyJhbG"'
            - " 'eyJhbG'"
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium