Windows File Decryption via Gpg4win gpg.exe Using Passphrase Flag

title: Windows File Decryption via Gpg4win gpg.exe Using Passphrase Flag
id: 785ce93f-a99c-4742-8f33-3719620f2186
status: test
description: This rule flags Windows process executions of Gpg4win's OpenPGP tools (gpg.exe or gpg2.exe) where the command line includes a decryption operation and the keyword 'passphrase'. Attackers commonly use OpenPGP utilities to decrypt or access protected data before further actions, so matching these command-line characteristics can help identify suspicious decryption activity. It relies on process creation telemetry, specifically the executable name and the full command line arguments.
references:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://www.gpg4win.de/documentation.html
  - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-09
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_metadata:
    - Image|endswith:
        - \gpg.exe
        - \gpg2.exe
    - Description: GnuPG’s OpenPGP tool
  selection_cli:
    CommandLine|contains|all:
      - " -d "
      - passphrase
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 037dcd71-33a8-4392-bb01-293c94663e5a
    type: derived