huntrule

Windows Portable Gpg.exe Execution from Uncommon Paths

Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-06
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Impact

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where an executable named gpg.exe (or gpg2.exe) is launched from a location other than common installed program directories. Attackers may use portable GnuPG binaries to encrypt or decrypt data during staging, impact, or loader workflows. It relies on Windows process creation telemetry, specifically the process image path ending in gpg.exe/gpg2.exe and the OriginalFileName and Description metadata used to identify GnuPG.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange
Malicious DarkAngels Linux Ransomware Ransom Note Creation via File System (via file_event)
Malicious DarkAngels Linux Ransomware Encrypted Extension and Log Artifacts via File System (via file_event)
Malicious Cyclops Ransomware File Artifacts (via file_event)
Malicious Mallox Ransomware Encryption Artifacts via Ransom Note and Extension (via file_event)
Malicious Backup and Recovery Destruction Chain via Dire Wolf Ransomware (via process_creation)
Malicious Dire Wolf Ransomware Encrypted File Extension on Disk (via file_event)
Malicious Lynx Ransomware Encryption Execution (via process_creation)
Malicious JADEPUFFER Lockd Encryptor Execution
Suspicious Mass Locked Extension File Creation by Ransomware
Windows Portable Gpg.exe Execution from Uncommon Paths
Pivot detection · T1486 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.