Windows Portable Gpg.exe Execution from Uncommon Paths

Flags gpg.exe/gpg2.exe launched from non-standard locations on Windows, based on process creation path and executable metadata.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-08-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1486Data Encrypted for Impact

What it detects

This rule flags process creation events where an executable named gpg.exe (or gpg2.exe) is launched from a location other than common installed program directories. Attackers may use portable GnuPG binaries to encrypt or decrypt data during staging, impact, or loader workflows. It relies on Windows process creation telemetry, specifically the process image path ending in gpg.exe/gpg2.exe and the OriginalFileName and Description metadata used to identify GnuPG.

Reporting behind it

Related detections9 linkedT1486 — drag to rearrange

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Suspicious CyberLock Ransomware Encrypted File Creation

Rhysida Ransomware Encrypted File Extension Created

Phobos 8Base Ransomware Encrypted File Extension Created

Rhysida Ransomware Note CriticalBreachDetected.pdf Created

Possible Akira Ransomware Note or Encrypted Extension Creation

Malicious Storm-2603 Ransom Note File Creation

Possible Ransomware Note or Encrypted File Extension Creation

BitLocker Feature Activation on Multiple Hosts - Native (via bitlocker)

Windows Portable Gpg.exe Execution from Uncommon Paths

Pivot detection · T1486 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-unusual-gpg-exe-or-gpg2-exe-execution-paths-77df53a5

title: Windows Portable Gpg.exe Execution from Uncommon Paths
id: 9fb4c5c3-4658-4d36-97f1-49138fa134e6
status: test
description: This rule flags process creation events where an executable named gpg.exe (or gpg2.exe) is launched from a location other than common installed program directories. Attackers may use portable GnuPG binaries to encrypt or decrypt data during staging, impact, or loader workflows. It relies on Windows process creation telemetry, specifically the process image path ending in gpg.exe/gpg2.exe and the OriginalFileName and Description metadata used to identify GnuPG.
references:
  - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a
  - https://securelist.com/locked-out/68960/
  - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-06
modified: 2023-11-10
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \gpg.exe
        - \gpg2.exe
    - OriginalFileName: gpg.exe
    - Description: GnuPG’s OpenPGP tool
  filter_main_legit_location:
    Image|contains:
      - :\Program Files (x86)\GNU\GnuPG\bin\
      - :\Program Files (x86)\GnuPG VS-Desktop\
      - :\Program Files (x86)\GnuPG\bin\
      - :\Program Files (x86)\Gpg4win\bin\
  condition: selection and not 1 of filter_main_*
level: medium
license: DRL-1.1
related:
  - id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL