Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags process creation events where the OriginalFileName is gpg.exe and the executed image name ends with gpg.exe or gpg2.exe, while excluding matches that fit additional image-name filters. Renaming legitimate binaries is a common technique to blend in while performing encryption-related actions used by malicious tooling. It relies on Windows process creation telemetry, including OriginalFileName and the process image path.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe

Pivot detection · T1486 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-execution-of-renamed-gpg-exe-or-gpg2-exe-ec0722a3

title: "Windows Process Creation: Execution of Renamed gpg.exe or gpg2.exe"
id: 48135d9a-d184-4994-a203-e49c28478d3d
status: test
description: This rule flags process creation events where the OriginalFileName is gpg.exe and the executed image name ends with gpg.exe or gpg2.exe, while excluding matches that fit additional image-name filters. Renaming legitimate binaries is a common technique to blend in while performing encryption-related actions used by malicious tooling. It relies on Windows process creation telemetry, including OriginalFileName and the process image path.
references:
  - https://securelist.com/locked-out/68960/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_gpg4win.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-08-09
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: gpg.exe
  filter_main_img:
    Image|endswith:
      - \gpg.exe
      - \gpg2.exe
  condition: selection and not 1 of filter_main_*
level: high
license: DRL-1.1
related:
  - id: ec0722a3-eb5c-4a56-8ab2-bf6f20708592
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL