Added the string corresponding to "{"alg":" since some token headers start with this

[ionsor]

Summary of the Pull Request

Added the string eyJhbGciOi corresponding to {"alg": from the JWT token header.

Changelog

update: Potentially Suspicious JWT Token Search Via CLI - added the eyJhbGciOi string, corresponding to {"alg": from the JWT token header.

Example Log Event

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[ionsor]

From my hunts I observed JWT tokens starting with "typ" either "alg", hence added the corresponding base64 string missing from the detection

[nasbench]

From my hunts I observed JWT tokens starting with "typ" either "alg", hence added the corresponding base64 string missing from the detection

For reviewing and testing purposes, can you provide a log sample. As you seem to have one at hand already. Thanks

[ionsor]

From my hunts I observed JWT tokens starting with "typ" either "alg", hence added the corresponding base64 string missing from the detection

For reviewing and testing purposes, can you provide a log sample. As you seem to have one at hand already. Thanks

Sure. Please see the attached printscreen from Chrome developer tools, hope it helps, otherwise the logs are collected through an EDR.