Potentially Suspicious JWT Token Search Via CLI

SigmaHQ Detections@sigmaHQ

•updated Oct 21, 2025•1•0•26

This rule detects attempts to search for JSON Web Tokens (JWTs) via command-line interface (CLI) tools. It specifically looks for common JWT header prefixes ('eyJ0eXAiOi' and 'eyJhbGciOi') within command-line arguments of tools like 'find', 'findstr', 'select-string', and 'strings'. Threat actors often search for these tokens to steal them for purposes such as lateral movement or privilege escalation, as JWTs are widely used for authentication and authorization in various applications and services (e.g., Microsoft 365, Azure, AWS, Google Cloud).