Windows File Encryption via Gpg4win (gpg.exe/gpg2.exe with passphrase)

title: Windows File Encryption via Gpg4win (gpg.exe/gpg2.exe with passphrase)
id: 3f7864e4-dc7f-4f13-98dd-23adb9e47912
status: test
description: This rule identifies Windows process creation where Gpg4win’s OpenPGP executables (gpg.exe or gpg2.exe) are used with command-line options indicating encryption that involves a passphrase. Attackers commonly encrypt files to protect data for staging or exfiltration, and to hinder analysis or recovery. The detection relies on process creation telemetry, matching the executable identity via path/filename and the presence of passphrase-related command-line arguments.
references:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://www.gpg4win.de/documentation.html
  - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-09
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_metadata:
    - Image|endswith:
        - \gpg.exe
        - \gpg2.exe
    - Description: GnuPG’s OpenPGP tool
  selection_cli:
    CommandLine|contains|all:
      - " -c "
      - passphrase
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 550bbb84-ce5d-4e61-84ad-e590f0024dcd
    type: derived