Windows Process Creation: Gpg4win File Encryption via gpg.exe or gpg2.exe
Flags Gpg4win (gpg.exe/gpg2.exe) executions using passphrase-based encryption on Windows.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-09
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process executions of Gpg4win’s OpenPGP utilities (gpg.exe or gpg2.exe) when used to encrypt files. Attackers commonly encrypt content to protect data from inspection, hide artifacts, or prepare staged payloads. The detection relies on process creation telemetry including the executable path/name and command-line arguments, specifically the presence of encryption mode and a passphrase reference.
Reporting behind it
- blogs.vmware.comhttps://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- gpg4win.dehttps://www.gpg4win.de/documentation.html
- news.sophos.comhttps://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-encryption-via-gpg4win-gpg-exe-gpg2-exe-with-passphrase-550bbb84
title: "Windows Process Creation: Gpg4win File Encryption via gpg.exe or gpg2.exe"
id: 3f7864e4-dc7f-4f13-98dd-23adb9e47912
status: test
description: This rule identifies Windows process executions of Gpg4win’s OpenPGP utilities (gpg.exe or gpg2.exe) when used to encrypt files. Attackers commonly encrypt content to protect data from inspection, hide artifacts, or prepare staged payloads. The detection relies on process creation telemetry including the executable path/name and command-line arguments, specifically the presence of encryption mode and a passphrase reference.
references:
- https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- https://www.gpg4win.de/documentation.html
- https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-09
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_metadata:
- Image|endswith:
- \gpg.exe
- \gpg2.exe
- Description: GnuPG’s OpenPGP tool
selection_cli:
CommandLine|contains|all:
- " -c "
- passphrase
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 550bbb84-ce5d-4e61-84ad-e590f0024dcd
type: derived