huntrule

Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

Alerts on Windows executions of renamed gpg.exe/gpg2.exe using process creation telemetry.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
Published
2023-08-09
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the OriginalFileName is gpg.exe and the executed image name ends with gpg.exe or gpg2.exe, while excluding matches that fit additional image-name filters. Renaming legitimate binaries is a common technique to blend in while performing encryption-related actions used by malicious tooling. It relies on Windows process creation telemetry, including OriginalFileName and the process image path.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)
Suspicious CyberLock Ransomware Encrypted File Creation
Rhysida Ransomware Encrypted File Extension Created
Phobos 8Base Ransomware Encrypted File Extension Created
Rhysida Ransomware Note CriticalBreachDetected.pdf Created
Possible Akira Ransomware Note or Encrypted Extension Creation
Malicious Storm-2603 Ransom Note File Creation
Possible Ransomware Note or Encrypted File Extension Creation
BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)
Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe
Pivot detection · T1486 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.