Windows File Decryption via Gpg4win (gpg.exe/gpg2.exe with passphrase prompt)
Identifies Windows Gpg4win (gpg.exe/gpg2.exe) decryption commands that include a passphrase keyword.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-09
- Updated
- 2026-07-31
What it detects
This rule identifies process creation events where Gpg4win’s OpenPGP executables (gpg.exe or gpg2.exe) are used with command-line flags indicating file decryption and a passphrase-related prompt. Attackers may use Gpg4win to decrypt protected payloads or artifacts before execution, making this a useful indicator of potential staging or execution preparation. Detection relies on Windows process creation telemetry capturing the executable path, its description, and the command-line parameters.
Reporting behind it
- blogs.vmware.comhttps://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- gpg4win.dehttps://www.gpg4win.de/documentation.html
- news.sophos.comhttps://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-decryption-via-gpg4win-gpg-exe-using-passphrase-flag-037dcd71
title: Windows File Decryption via Gpg4win (gpg.exe/gpg2.exe with passphrase prompt)
id: 785ce93f-a99c-4742-8f33-3719620f2186
status: test
description: This rule identifies process creation events where Gpg4win’s OpenPGP executables (gpg.exe or gpg2.exe) are used with command-line flags indicating file decryption and a passphrase-related prompt. Attackers may use Gpg4win to decrypt protected payloads or artifacts before execution, making this a useful indicator of potential staging or execution preparation. Detection relies on Windows process creation telemetry capturing the executable path, its description, and the command-line parameters.
references:
- https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- https://www.gpg4win.de/documentation.html
- https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-09
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_metadata:
- Image|endswith:
- \gpg.exe
- \gpg2.exe
- Description: GnuPG’s OpenPGP tool
selection_cli:
CommandLine|contains|all:
- " -d "
- passphrase
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 037dcd71-33a8-4392-bb01-293c94663e5a
type: derived