All Detections

Potentially Suspicious JWT Token Search Via CLI

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.

Sigma