Windows: Gpg4win (GnuPG) Encrypt/Decrypt Command Using Suspicious File Paths
Flags Gpg4win/GnuPG file crypto commands using -passphrase with activity in temporary/public or suspicious Windows directories.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-30
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process executions of Gpg4win’s GnuPG tooling (gpg.exe/gpg2.exe) performing file encryption or decryption using a command line that includes the -passphrase option. It further narrows matches to activity where the command line references commonly abused or staging-like locations such as Temp, Public profiles, PerfLogs, and AppData temp directories. Attackers often use OpenPGP tooling to protect malicious payloads, exfiltrate data, or obscure intent while operating from transient user or system directories. The detection relies on Windows process creation telemetry including image name, product/description metadata, and full command-line content.
Reporting behind it
- blogs.vmware.comhttps://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- news.sophos.comhttps://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Gpg4win (GnuPG) Encrypt/Decrypt Command Using Suspicious File Paths"
id: 44be1806-bcaf-4a17-82cb-eaa067f78275
status: test
description: This rule identifies Windows process executions of Gpg4win’s GnuPG tooling (gpg.exe/gpg2.exe) performing file encryption or decryption using a command line that includes the -passphrase option. It further narrows matches to activity where the command line references commonly abused or staging-like locations such as Temp, Public profiles, PerfLogs, and AppData temp directories. Attackers often use OpenPGP tooling to protect malicious payloads, exfiltrate data, or obscure intent while operating from transient user or system directories. The detection relies on Windows process creation telemetry including image name, product/description metadata, and full command-line content.
references:
- https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
- https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems), Huntrule Team
date: 2022-11-30
modified: 2023-08-09
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_metadata:
- Image|endswith:
- \gpg.exe
- \gpg2.exe
- Product: GNU Privacy Guard (GnuPG)
- Description: GnuPG’s OpenPGP tool
selection_cli:
CommandLine|contains: -passphrase
selection_paths:
CommandLine|contains:
- :\PerfLogs\
- :\Temp\
- :\Users\Public\
- :\Windows\Temp\
- \AppData\Local\Temp\
- \AppData\Roaming\
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d
type: derived