Windows CLI Searching for JWT Strings (eyJ0eX / eyJhbGci) in Command Line

Flags Windows CLI token hunting when search utilities are used alongside JWT-like substrings in the command line.

FreeUnreviewedSigmamediumv1

windows-cli-searching-for-jwt-strings-eyj0ex-eyjhbgci-in-command-line-6d3a3952

title: Windows CLI Searching for JWT Strings (eyJ0eX / eyJhbGci) in Command Line
id: d0b5e32c-68b1-45f2-b3f7-3038014804b8
status: test
description: This rule flags Windows process creation events where a command-line includes common text-search utilities (e.g., find, findstr, select-string, strings) together with JWT-like base64 substrings such as "eyJ0eX" or "eyJhbGci". Searching for JWT token patterns via CLI can indicate credential harvesting or reconnaissance for exposed or saved tokens. The detection relies on process creation telemetry with the full command line and checks for both the search tool usage and the presence of JWT-like strings.
references:
  - https://mrd0x.com/stealing-tokens-from-office-applications/
  - https://www.scip.ch/en/?labs.20240523
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml
author: Nasreddine Bencherchali (Nextron Systems), kagebunsher, Huntrule Team
date: 2022-10-25
modified: 2025-10-21
tags:
  - attack.credential-access
  - attack.t1528
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    CommandLine|contains:
      - "find "
      - find.exe
      - findstr
      - "select-string "
      - strings
  selection_jwt_string:
    CommandLine|contains:
      - eyJ0eXAiOi
      - eyJhbGciOi
      - " eyJ0eX"
      - ' "eyJ0eX"'
      - " 'eyJ0eX'"
      - " eyJhbG"
      - ' "eyJhbG"'
      - " 'eyJhbG'"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6d3a3952-6530-44a3-8554-cf17c116c615
    type: derived

What it detects

This rule flags Windows process creation events where a command-line includes common text-search utilities (e.g., find, findstr, select-string, strings) together with JWT-like base64 substrings such as "eyJ0eX" or "eyJhbGci". Searching for JWT token patterns via CLI can indicate credential harvesting or reconnaissance for exposed or saved tokens. The detection relies on process creation telemetry with the full command line and checks for both the search tool usage and the presence of JWT-like strings.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.