Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

title: "Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe"
id: 48135d9a-d184-4994-a203-e49c28478d3d
status: test
description: This rule flags process creation events where the OriginalFileName is gpg.exe and the executed image name ends with gpg.exe or gpg2.exe, while excluding matches that fit additional image-name filters. Renaming legitimate binaries is a common technique to blend in while performing encryption-related actions used by malicious tooling. It relies on Windows process creation telemetry, including OriginalFileName and the process image path.
references:
  - https://securelist.com/locked-out/68960/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_gpg4win.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-08-09
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: gpg.exe
  filter_main_img:
    Image|endswith:
      - \gpg.exe
      - \gpg2.exe
  condition: selection and not 1 of filter_main_*
level: high
license: DRL-1.1
related:
  - id: ec0722a3-eb5c-4a56-8ab2-bf6f20708592
    type: derived