Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Exfiltration-GPGAsymmetricArchiveExfil.
Upgrade to ProDetect Asymmetric Public-Key Encrypted Archive Exfiltration (GPG/OpenSSL/age) in Splunk
Rather than relying on a shared secret or a symmetric session key that could be recovered from memory forensics or a network capture, some adversaries and malicious insiders encrypt staged data with an attacker-controlled public key before it ever leaves the host. Tooling observed for this includes GPG/GPG2 invoked with `--recipient`/`-r` against a hardcoded or embedded public key (as opposed to `--symmetric`/`-c`, which uses a shared passphrase), `openssl smime -encrypt` against a recipient certificate, and the modern `age` utility invoked with `-r`/`--recipient` rather than `-p`/`--passphrase`. Because only the holder of the corresponding private key can ever decrypt the resulting `.gpg`/`.pgp`/`.p7m`/`.age` file, this defeats DLP content inspection and gives defenders no way to recover the plaintext even with full access to the transfer, unlike a password-protected archive whose passphrase might be brute-forced or recovered from the intruder's session. The encrypted archive is then moved off-host over a generic channel — a `curl`/`Invoke-WebRequest` upload to a file-sharing, paste, or webhook endpoint, or a drop into cloud storage — that is deliberately decoupled from any tasking/C2 channel already in use, so the exfiltration blends in with ordinary outbound HTTPS traffic. This pattern shows up both in insider IP theft (an employee quietly PGP-encrypting a document set to their personal key before uploading it) and in ransomware-affiliate double-extortion tooling that stages and asymmetrically encrypts a batch of high-value files immediately before the encryptor payload runs.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\openssl.exe" OR Image="*\\age.exe")
(CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*smime*")
NOT (CommandLine="*--symmetric*" OR CommandLine="*--passphrase*" OR CommandLine="*-c *"))
| eval Signal="AsymmetricEncryptionInvoked", RiskScore=55
| table _time host User Image CommandLine Signal RiskScore
| append
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
(TargetFilename="*.gpg" OR TargetFilename="*.pgp" OR TargetFilename="*.asc" OR TargetFilename="*.p7m" OR TargetFilename="*.age")
| stats dc(TargetFilename) AS DistinctFiles BY host, User, Image, _time span=15m
| where DistinctFiles>=5
| eval Signal="BulkAsymmetricStaging", RiskScore=70
| table _time host User Image DistinctFiles Signal RiskScore ]
| append
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 DestinationPort IN (443,80,21)
| stats count AS ConnectionCount BY host, User, Image, DestinationIp, DestinationPort, _time span=10m
| eval Signal="PostEncryptionUpload", RiskScore=85
| table _time host User Image DestinationIp DestinationPort ConnectionCount Signal RiskScore ]
| sort - RiskScore - _timeSPL detection combining Sysmon process creation (EventCode=1) for gpg/openssl/age invoked with a public-key recipient flag rather than a symmetric passphrase flag, Sysmon file creation (EventCode=11) for bulk staging of asymmetrically-encrypted output artifacts within a 15-minute window, and Sysmon network connection (EventCode=3) for outbound HTTP(S)/FTP connections that follow the encrypted artifact being written.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Release/build automation invoking gpg or openssl smime against a known partner public key on a schedule
- Backup agents encrypting export files with gpg before an outbound transfer to an approved offsite target
- Scheduled compliance jobs that gpg-encrypt log exports before archival to cold storage
Other platforms for THREAT-Exfiltration-GPGAsymmetricArchiveExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate GPG Public-Key Encryption of Staged Files
Expected signal: Sysmon Event ID 1 for gpg.exe launched with --recipient and --encrypt in the command line; Sysmon Event ID 11 for the resulting .gpg output files.
- Test 2Simulate Bulk Asymmetric Staging
Expected signal: Sysmon Event ID 11 showing six .gpg files created by the same process within a 15-minute window.
- Test 3Simulate Post-Encryption Upload of an Asymmetrically-Encrypted Archive
Expected signal: Sysmon Event ID 11 for the .gpg file creation followed within minutes by Sysmon Event ID 3 showing an outbound HTTPS connection to the test endpoint from powershell.exe.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Exfiltration-GPGAsymmetricArchiveExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (1)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.