Merge PR #5012 from @ionsor - Update `Potentially Suspicious JWT Toke…

…n Search Via CLI` update: Potentially Suspicious JWT Token Search Via CLI - added the `eyJhbGciOi` string, corresponding to `{"alg":` from the JWT token header. --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
SigmaHQ · Oct 6, 2024 · 5b59c6d · 5b59c6d
1 parent d1f1fc7
commit 5b59c6d
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/...creation_win_susp_office_token_search.yml → ...oc_creation_win_susp_jwt_token_search.yml b/...creation_win_susp_office_token_search.yml → ...oc_creation_win_susp_jwt_token_search.yml
@@ -1,11 +1,14 @@
-title: Suspicious Office Token Search Via CLI
+title: Potentially Suspicious JWT Token Search Via CLI
 id: 6d3a3952-6530-44a3-8554-cf17c116c615
 status: test
-description: Detects possible search for office tokens via CLI by looking for the string "eyJ0eX". This string is used as an anchor to look for the start of the JWT token used by office and similar apps.
+description: |
+    Detects possible search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
+    This string is used as an anchor to look for the start of the JWT token used by microsoft office and similar apps.
 references:
     - https://mrd0x.com/stealing-tokens-from-office-applications/
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2022-10-25
+modified: 2024-10-06
 tags:
     - attack.credential-access
     - attack.t1528
@@ -16,9 +19,13 @@ detection:
     selection:
         CommandLine|contains:
             - 'eyJ0eXAiOi' # {"typ":
+            - 'eyJhbGciOi' # {"alg":
             - ' eyJ0eX'
             - ' "eyJ0eX"'
             - " 'eyJ0eX'"
+            - ' eyJhbG'
+            - ' "eyJhbG"'
+            - " 'eyJhbG'"
     condition: selection
 falsepositives:
     - Unknown