Asymmetric Public-Key Encrypted Archive Exfiltration (GPG/OpenSSL/age)

let EncTargetExt = dynamic([".gpg", ".pgp", ".asc", ".p7m", ".age"]);
// Signal 1: gpg/openssl/age invoked with a public-key recipient flag rather than a symmetric passphrase flag
let AsymmetricEncryptionInvoked = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("gpg.exe", "gpg2.exe", "openssl.exe", "age.exe")
| where (FileName in~ ("gpg.exe", "gpg2.exe") and ProcessCommandLine has_any ("--recipient", "-r ") and not(ProcessCommandLine has_any ("--symmetric", "-c ", "--passphrase")))
    or (FileName =~ "openssl.exe" and ProcessCommandLine has "smime" and ProcessCommandLine has_any ("-encrypt", "-enc"))
    or (FileName =~ "age.exe" and ProcessCommandLine has_any ("-r ", "--recipient") and not(ProcessCommandLine has_any ("-p", "--passphrase")))
| extend Signal = "AsymmetricEncryptionInvoked", RiskScore = 55
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, Signal, RiskScore;
// Signal 2: an asymmetrically-encrypted output artifact is written to disk
let EncryptedOutputCreated = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (EncTargetExt)
| extend Signal = "EncryptedOutputFileCreated", RiskScore = 40
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, ProcessCommandLine = FolderPath, InitiatingProcessFileName, Signal, RiskScore;
// Signal 3: several distinct encrypted archives staged by the same process in a short window
let BulkAsymmetricStaging = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (EncTargetExt)
| summarize DistinctFiles = dcount(FileName), Paths = make_set(FolderPath, 5) by DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, bin(Timestamp, 15m)
| where DistinctFiles >= 5
| extend Signal = "BulkAsymmetricStaging", RiskScore = 70
| project Timestamp, DeviceName, AccountName, FileName = "(multiple)", ProcessCommandLine = strcat("DistinctFiles=", tostring(DistinctFiles)), InitiatingProcessFileName, Signal, RiskScore;
// Signal 4: an outbound connection to a public host follows creation of the encrypted artifact within 10 minutes
let PostEncryptionUpload = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (EncTargetExt)
| project EncTime = Timestamp, DeviceName, EncFileName = FileName, EncProcess = InitiatingProcessFileName
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where ActionType =~ "ConnectionSuccess"
    | where RemoteIPType == "Public"
    | where RemotePort in (443, 80, 21)
    | project NetTime = Timestamp, DeviceName, NetProcess = InitiatingProcessFileName, RemoteIP, RemotePort
  ) on DeviceName
| where (NetTime - EncTime) between (0min .. 10min)
| extend Signal = "PostEncryptionUpload", RiskScore = 85
| project Timestamp = NetTime, DeviceName, AccountName = "", FileName = EncFileName, ProcessCommandLine = strcat(tostring(RemoteIP), ":", tostring(RemotePort)), InitiatingProcessFileName = NetProcess, Signal, RiskScore;
union AsymmetricEncryptionInvoked, EncryptedOutputCreated, BulkAsymmetricStaging, PostEncryptionUpload
| sort by RiskScore desc, Timestamp desc

(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\openssl.exe" OR Image="*\\age.exe")
  (CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*smime*")
  NOT (CommandLine="*--symmetric*" OR CommandLine="*--passphrase*" OR CommandLine="*-c *"))
| eval Signal="AsymmetricEncryptionInvoked", RiskScore=55
| table _time host User Image CommandLine Signal RiskScore
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*.gpg" OR TargetFilename="*.pgp" OR TargetFilename="*.asc" OR TargetFilename="*.p7m" OR TargetFilename="*.age")
      | stats dc(TargetFilename) AS DistinctFiles BY host, User, Image, _time span=15m
      | where DistinctFiles>=5
      | eval Signal="BulkAsymmetricStaging", RiskScore=70
      | table _time host User Image DistinctFiles Signal RiskScore ]
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 DestinationPort IN (443,80,21)
      | stats count AS ConnectionCount BY host, User, Image, DestinationIp, DestinationPort, _time span=10m
      | eval Signal="PostEncryptionUpload", RiskScore=85
      | table _time host User Image DestinationIp DestinationPort ConnectionCount Signal RiskScore ]
| sort - RiskScore - _time

sequence by host.name with maxspan=15m
  [process where event.type == "start" and
    process.name : ("gpg.exe", "gpg2.exe", "openssl.exe", "age.exe") and
    process.command_line : ("*--recipient*", "*-r *", "*smime*") and
    not process.command_line : ("*--symmetric*", "*--passphrase*", "*-c *")
  ]
  [file where event.type == "creation" and
    file.extension : ("gpg", "pgp", "asc", "p7m", "age")
  ]
  [network where event.type == "connection" and
    destination.port in (443, 80, 21) and
    network.direction == "outbound"
  ]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "Process Name" AS ProcessName,
    "Command Line" AS CommandLine,
    destinationip AS DestinationIP,
    destinationport AS DestinationPort,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    'AsymmetricEncryptedExfil' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    (
        "Process Name" MATCHES '.*(gpg|gpg2|openssl|age)\.exe$'
        AND "Command Line" MATCHES '.*(--recipient|-r |smime).*'
        AND "Command Line" NOT MATCHES '.*(--symmetric|--passphrase|-c ).*'
    )
    OR (
        destinationport IN (443, 80, 21)
        AND qidname(qid) = 'Firewall Permit'
    )
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

(_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=1
  (Image matches "*\\gpg.exe" OR Image matches "*\\gpg2.exe" OR Image matches "*\\openssl.exe" OR Image matches "*\\age.exe")
  (CommandLine matches "*--recipient*" OR CommandLine matches "*-r *" OR CommandLine matches "*smime*")
  !(CommandLine matches "*--symmetric*" OR CommandLine matches "*--passphrase*" OR CommandLine matches "*-c *")
| eval Signal="AsymmetricEncryptionInvoked", RiskScore=55
| fields _messagetime, ComputerName, User, Image, CommandLine, Signal, RiskScore
| union (
    (_sourceCategory="windows/sysmon" OR _sourceCategory="endpoint/windows/sysmon") EventCode=3
    (DestinationPort=443 OR DestinationPort=80 OR DestinationPort=21)
    | timeslice 10m
    | count AS ConnectionCount BY ComputerName, User, Image, DestinationIp, DestinationPort, _timeslice
    | eval Signal="PostEncryptionUpload", RiskScore=85
    | fields _timeslice, ComputerName, User, Image, DestinationIp, DestinationPort, ConnectionCount, Signal, RiskScore
  )
| sort by RiskScore desc

rule asymmetric_encrypted_archive_exfil {
  meta:
    author = "df00tech"
    description = "Detects public-key (asymmetric) encryption of staged data via gpg/openssl/age followed by an outbound transfer"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.002"
    reference = "https://attack.mitre.org/techniques/T1048/002/"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($proc.target.process.file.full_path, `(?i)(gpg|gpg2|openssl|age)(\.exe)?$`)
    re.regex($proc.target.process.command_line, `(?i)(--recipient|-r |smime)`)
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.target.port = 443 or $net.target.port = 80 or $net.target.port = 21
    $proc.principal.hostname = $net.principal.hostname

  match:
    $proc.principal.hostname over 15m

  condition:
    $proc and $net
}

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)(gpg2?|openssl|age)\.exe$/
| CommandLine=/(?i)(--recipient|-r\s|smime)/
| CommandLine!=/(?i)(--symmetric|--passphrase|-c\s)/
| Signal := "AsymmetricEncryptionInvoked"
| RiskScore := 55
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, Signal], function=[count(as=EventCount), max(field=RiskScore, as=MaxRisk)])
| sort(field=MaxRisk, order=desc)