Query: write Sigma for Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens
Matching passage: Sigma rule: Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens. Logsource: windows / process_creation. Rule: title: Potentially Suspicious JWT Token Search Via CLI id: 6d3a3952-6530-44a3-8554-cf17c116c615 status: test description: 'Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation. ' references: - https://mrd0x.com/stealing-tokens-from-office-applications/ - https://www.scip.ch/en/?labs.20240523 author: Nasreddine Bencherchali (Nextron Systems), kagebunsher date: 2022-10-25 modified: 2025-10-21 tags: - attack.credential-access - attack.t1528 - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_tools: CommandLine|contains: - 'find ' - find.exe - findstr - 'select-string ' - strings selection_jwt_string: CommandLine|contains: - eyJ0eXAiOi - eyJhbGciOi - ' eyJ0eX' - ' "eyJ0eX"' - ' ''eyJ0eX''' - ' eyJhbG' - ' "eyJhbG"' - ' ''eyJhbG''' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege. Logsource: windows / process_creation. Rule: title: Always Install Elevated Windows Installer id: cd951fdc-4b2f-47f5-ba99-a33bf61e3770 status: test description: Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_user: User|contains: - AUTHORI - AUTORI selection_image_1: Image|contains|all: - \Windows\Installer\ - msi Image|endswith: tmp selection_image_2: Image|endswith: \msiexec.exe IntegrityLevel: - System - S-1-16-16384 filter_installer: ParentImage: C:\Windows\System32\services.exe filter_repair: - CommandLine|endswith: \system32\msiexec.exe /V - ParentCommandLine|endswith: \system32\msiexec.exe /V filter_sophos: ParentImage|startswith: C:\ProgramData\Sophos\ filter_avira: ParentImage|startswith: C:\ProgramData\Avira\ filter_avast: ParentImage|startswith: - C:\Program Files\Avast Software\ - C:\Program Files (x86)\Avast Software\ filter_google_update: ParentImage|startswith: - C:\Program Files\Google\Update\ - C:\Program Files (x86)\Google\Update\ condition: 1 of selection_image_* and selection_user and not 1 of filter_* falsepositives: - System administrator usage - Anti virus products - WindowsApps located in "C:\Program Files\WindowsApps\" level: medium