Windows Process Creation: Unusual gpg.exe or gpg2.exe Execution Paths

title: "Windows Process Creation: Unusual gpg.exe or gpg2.exe Execution Paths"
id: 9fb4c5c3-4658-4d36-97f1-49138fa134e6
status: test
description: This rule identifies when a Windows process is created for gpg.exe or gpg2.exe from an uncommon directory by matching the executable name and file metadata. Attackers may use portable GnuPG utilities to encrypt, decrypt, or package data during impact or staging activities. It relies on Windows process creation telemetry, including the process Image path plus OriginalFileName and Description fields to confirm the executable identity while excluding common installed locations.
references:
  - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a
  - https://securelist.com/locked-out/68960/
  - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-06
modified: 2023-11-10
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \gpg.exe
        - \gpg2.exe
    - OriginalFileName: gpg.exe
    - Description: GnuPG’s OpenPGP tool
  filter_main_legit_location:
    Image|contains:
      - :\Program Files (x86)\GNU\GnuPG\bin\
      - :\Program Files (x86)\GnuPG VS-Desktop\
      - :\Program Files (x86)\GnuPG\bin\
      - :\Program Files (x86)\Gpg4win\bin\
  condition: selection and not 1 of filter_main_*
level: medium
license: DRL-1.1
related:
  - id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41
    type: derived