Windows: Gpg4win (gpg.exe) Encrypt/Decrypt Using Passphrases from Suspicious Paths

title: "Windows: Gpg4win (gpg.exe) Encrypt/Decrypt Using Passphrases from Suspicious Paths"
id: 44be1806-bcaf-4a17-82cb-eaa067f78275
status: test
description: This rule identifies process executions of Gpg4win/GnuPG OpenPGP tools (gpg.exe or gpg2.exe) when encrypting or decrypting content using a provided passphrase. It is designed to catch attackers staging or protecting files from common temporary and public directories, where malicious tooling often works before exfiltration or persistence. The detection relies on Windows process creation telemetry including image name, product/description metadata, and command-line arguments and paths.
references:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-11-30
modified: 2023-08-09
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_metadata:
    - Image|endswith:
        - \gpg.exe
        - \gpg2.exe
    - Product: GNU Privacy Guard (GnuPG)
    - Description: GnuPG’s OpenPGP tool
  selection_cli:
    CommandLine|contains: -passphrase
  selection_paths:
    CommandLine|contains:
      - :\PerfLogs\
      - :\Temp\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d
    type: derived