Windows CLI Searching for JWT Strings (eyJ0eX / eyJhbGci) in Command Line

Flags Windows CLI token hunting when search utilities are used alongside JWT-like substrings in the command line.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems), kagebunsher (SigmaHQ), DRL 1.1
Published: 2022-10-25
Updated: 2026-07-30

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1528Steal Application Access Token
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where a command-line includes common text-search utilities (e.g., find, findstr, select-string, strings) together with JWT-like base64 substrings such as "eyJ0eX" or "eyJhbGci". Searching for JWT token patterns via CLI can indicate credential harvesting or reconnaissance for exposed or saved tokens. The detection relies on process creation telemetry with the full command line and checks for both the search tool usage and the presence of JWT-like strings.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Malicious OAuth Application Granted Full Mailbox and EWS Permissions (via m365)

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Suspicious GAM OAuth Token Enumeration via Process Creation

Suspicious Shai-Hulud Worm Stager Execution from Temp (via process_creation)

Suspicious prt-scan Campaign Credential Harvesting via proc environ Scan (via process_creation)

Possible Stolen AWS Credential Validation via STS GetCallerIdentity

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Windows CLI Searching for JWT Strings (eyJ0eX / eyJhbGci) in Command Line

Pivot detection · T1552.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-cli-searching-for-jwt-strings-eyj0ex-eyjhbgci-in-command-line-6d3a3952

title: Windows CLI Searching for JWT Strings (eyJ0eX / eyJhbGci) in Command Line
id: d0b5e32c-68b1-45f2-b3f7-3038014804b8
status: test
description: This rule flags Windows process creation events where a command-line includes common text-search utilities (e.g., find, findstr, select-string, strings) together with JWT-like base64 substrings such as "eyJ0eX" or "eyJhbGci". Searching for JWT token patterns via CLI can indicate credential harvesting or reconnaissance for exposed or saved tokens. The detection relies on process creation telemetry with the full command line and checks for both the search tool usage and the presence of JWT-like strings.
references:
  - https://mrd0x.com/stealing-tokens-from-office-applications/
  - https://www.scip.ch/en/?labs.20240523
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml
author: Nasreddine Bencherchali (Nextron Systems), kagebunsher, Huntrule Team
date: 2022-10-25
modified: 2025-10-21
tags:
  - attack.credential-access
  - attack.t1528
  - attack.t1552.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    CommandLine|contains:
      - "find "
      - find.exe
      - findstr
      - "select-string "
      - strings
  selection_jwt_string:
    CommandLine|contains:
      - eyJ0eXAiOi
      - eyJhbGciOi
      - " eyJ0eX"
      - ' "eyJ0eX"'
      - " 'eyJ0eX'"
      - " eyJhbG"
      - ' "eyJhbG"'
      - " 'eyJhbG'"
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6d3a3952-6530-44a3-8554-cf17c116c615
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL