Data Exfiltration via PGP/GPG-Encrypted Email Attachments

let InternalMailDomains = dynamic(["contoso.com"]); // replace with your organization's verified tenant domain(s)
let PgpExtensions = dynamic([".gpg", ".pgp", ".asc", ".p7m"]);
let GpgProcessNames = dynamic(["gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe"]);
let GpgEncryptFlags = dynamic(["--encrypt", "--recipient", "-r ", "-e "]);
let OutboundPgpAttachments = EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == "Outbound"
| join kind=inner (
    EmailAttachmentInfo
    | where Timestamp > ago(24h)
    | where FileName has_any (PgpExtensions)
  ) on NetworkMessageId
| extend RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
| where RecipientDomain !in~ (InternalMailDomains);
// Signal 1: a single outbound email with an asymmetric-encrypted attachment sent to an external recipient
let PgpEmailExfil = OutboundPgpAttachments
| extend Actor = SenderFromAddress, Target = RecipientEmailAddress, Detail = FileName, Signal = "PgpEncryptedAttachmentOutbound", RiskScore = 80
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
// Signal 2: a burst of 3+ such emails from one sender within an hour — bulk staged exfiltration rather than a single ad hoc message
let BulkPgpAttachmentBurst = OutboundPgpAttachments
| summarize AttachmentCount = count(), UniqueRecipients = dcount(RecipientEmailAddress) by SenderFromAddress, bin(Timestamp, 1h)
| where AttachmentCount >= 3
| extend Actor = SenderFromAddress, Target = "(multiple)", Detail = strcat("AttachmentCount=", tostring(AttachmentCount), " UniqueRecipients=", tostring(UniqueRecipients)), Signal = "BulkPgpAttachmentBurst", RiskScore = 90
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
// Signal 3: GPG/GPG4Win/Kleopatra encryption invoked on an endpoint — the collection/encryption step that precedes the email send
let GpgEncryptRaw = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (GpgProcessNames)
| where ProcessCommandLine has_any (GpgEncryptFlags);
let GpgEncryptInvoked = GpgEncryptRaw
| extend Actor = DeviceName, Target = AccountName, Detail = ProcessCommandLine, Signal = "GpgEncryptInvoked", RiskScore = 55
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
// Signal 4: an external party's public key is imported into the local keyring within 15 minutes before it is used to encrypt data — just-in-time exfiltration prep, especially for a user with no prior PGP usage history
let KeyImportRaw = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (GpgProcessNames)
| where ProcessCommandLine has "--import"
| project ImportTime = Timestamp, DeviceName, AccountName;
let GpgKeyImportThenEncrypt = GpgEncryptRaw
| join kind=inner (KeyImportRaw) on DeviceName, AccountName
| where Timestamp - ImportTime between (0min .. 15min)
| extend Actor = DeviceName, Target = AccountName, Detail = ProcessCommandLine, Signal = "GpgKeyImportThenEncrypt", RiskScore = 70
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
union PgpEmailExfil, BulkPgpAttachmentBurst, GpgEncryptInvoked, GpgKeyImportThenEncrypt
| sort by RiskScore desc, Timestamp desc

sourcetype="o365:management:activity" RecordType=DLPRuleMatch Workload=Exchange
| spath output=AttachmentExt path=AttachmentData{}.Extension
| search AttachmentExt IN ("gpg","pgp","asc","p7m")
| eval Actor=SenderAddress, Target=Recipients, Detail=AttachmentExt, Signal="PgpEncryptedAttachmentOutbound", RiskScore=80
| table _time Actor Target Detail Signal RiskScore
| append
    [ search sourcetype="o365:management:activity" RecordType=DLPRuleMatch Workload=Exchange
      | spath output=AttachmentExt path=AttachmentData{}.Extension
      | search AttachmentExt IN ("gpg","pgp","asc","p7m")
      | bin _time span=1h
      | stats count AS AttachmentCount, dc(Recipients) AS UniqueRecipients BY SenderAddress, _time
      | where AttachmentCount>=3
      | eval Actor=SenderAddress, Target="(multiple)", Detail="AttachmentCount=".AttachmentCount." UniqueRecipients=".UniqueRecipients, Signal="BulkPgpAttachmentBurst", RiskScore=90
      | table _time Actor Target Detail Signal RiskScore ]
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\gpg4win*.exe" OR Image="*\\kleopatra.exe")
      (CommandLine="*--encrypt*" OR CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*-e *")
      | eval Actor=host, Target=User, Detail=CommandLine, Signal="GpgEncryptInvoked", RiskScore=55
      | table _time Actor Target Detail Signal RiskScore ]
| sort - RiskScore -_time

sequence by process.entity_id with maxspan=10m
  [process where event.type == "start" and
    process.name : ("gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe") and
    process.command_line : ("*--encrypt*", "*--recipient*", "*-r *", "*-e *")
  ]
  [file where event.type in ("creation", "change") and
    file.extension : ("gpg", "pgp", "asc", "p7m")
  ]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    "Sender Address" AS SenderAddress,
    "Recipient Address" AS RecipientAddress,
    "Attachment Extension" AS AttachmentExtension,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    'PgpEncryptedAttachmentOutbound' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) = 'Microsoft Office 365'
  AND "Record Type" = 'DLPRuleMatch'
  AND "Workload" = 'Exchange'
  AND "Attachment Extension" IN ('gpg', 'pgp', 'asc', 'p7m')
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory="o365/management/activity" RecordType=DLPRuleMatch Workload=Exchange
| json field=_raw "AttachmentData" as AttachmentDataJson nodrop
| parse regex field=AttachmentDataJson "\"Extension\"\s*:\s*\"(?<AttachmentExt>[a-zA-Z0-9]+)\""
| where AttachmentExt matches "gpg" or AttachmentExt matches "pgp" or AttachmentExt matches "asc" or AttachmentExt matches "p7m"
| eval Signal="PgpEncryptedAttachmentOutbound", RiskScore=80
| fields _messagetime, SenderAddress, Recipients, AttachmentExt, Signal, RiskScore
| union (
    _sourceCategory="windows/sysmon" EventCode=1
    (Image matches "*\\gpg.exe" OR Image matches "*\\gpg2.exe" OR Image matches "*\\gpg4win*.exe" OR Image matches "*\\kleopatra.exe")
    (CommandLine matches "*--encrypt*" OR CommandLine matches "*--recipient*" OR CommandLine matches "*-r *" OR CommandLine matches "*-e *")
    | eval Signal="GpgEncryptInvoked", RiskScore=55
    | fields _messagetime, ComputerName, User, Image, CommandLine, Signal, RiskScore
  )
| sort by RiskScore desc

rule pgp_encrypted_email_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects outbound email carrying a PGP/GPG or S/MIME asymmetric-encrypted attachment sent to an external recipient"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.002"
    reference = "https://attack.mitre.org/techniques/T1048/002/"

  events:
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.network.email.direction = "OUTBOUND"
    re.regex($email.network.email.attachments.filename, `(?i)\.(gpg|pgp|asc|p7m)$`)

  match:
    $email.principal.user.userid over 1h

  condition:
    $email
}

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)\\(gpg|gpg2|gpg4win.*|kleopatra)\.exe$/
| CommandLine=/(?i)(--encrypt|--recipient|-r\s|-e\s)/
| Signal := "GpgEncryptInvoked"
| RiskScore := 55
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, Signal], function=[count(as=EventCount), max(field=RiskScore, as=MaxRisk)])
| sort(field=MaxRisk, order=desc)