Detectionhightest

File Encryption/Decryption Via Gpg4win From Suspicious Locations

Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)Created Wed Nov 30Updated Wed Aug 09e1e0b7d7-e10b-4ee4-ac49-a4bda05d320dwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_metadata:
        - Image|endswith:
              - '\gpg.exe'
              - '\gpg2.exe'
        - Product: 'GNU Privacy Guard (GnuPG)'
        - Description: 'GnuPG’s OpenPGP tool'
    selection_cli:
        CommandLine|contains: '-passphrase'
    selection_paths:
        CommandLine|contains:
            - ':\PerfLogs\'
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    condition: all of selection_*