Which SIEM platforms have a THREAT-PGPEmail-AsymmetricEncryptedExfil detection rule?

df00tech provides THREAT-PGPEmail-AsymmetricEncryptedExfil (Data Exfiltration via PGP/GPG-Encrypted Email Attachments) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-PGPEmail-AsymmetricEncryptedExfil detection?

The THREAT-PGPEmail-AsymmetricEncryptedExfil detection is rated high severity with medium confidence.

What are common false positives for THREAT-PGPEmail-AsymmetricEncryptedExfil?

Common false positives for THREAT-PGPEmail-AsymmetricEncryptedExfil include: Legitimate business use of PGP/GPG for signing or encrypting vendor communications, software release artifacts, or financial documents — build an allowlist of known business recipients/domains and users with a documented, recurring PGP usage pattern; Security or DevOps teams distributing GPG-encrypted credentials, API keys, or backup exports to external partners as an approved secrets-sharing workflow; Legal or compliance teams encrypting sensitive documents (M&A due diligence, privileged communications) for external counsel using S/MIME or PGP, which is expected and should be excluded once verified.

THREAT-PGPEmail-AsymmetricEncryptedExfil: Data Exfiltration via PGP/GPG-Encrypted Email Attachments — Detection (KQL, SPL, Sigma + 5 SIEMs)

Q: What data sources are required to detect Data Exfiltration via PGP/GPG-Encrypted Email Attachments (THREAT-PGPEmail-AsymmetricEncryptedExfil)?

Detecting Data Exfiltration via PGP/GPG-Encrypted Email Attachments requires the following data sources: Microsoft Defender for Office 365 (EmailEvents, EmailAttachmentInfo), Microsoft Defender for Endpoint (DeviceProcessEvents).

Microsoft Sentinel / Defender

kusto

let InternalMailDomains = dynamic(["contoso.com"]); // replace with your organization's verified tenant domain(s)
let PgpExtensions = dynamic([".gpg", ".pgp", ".asc", ".p7m"]);
let GpgProcessNames = dynamic(["gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe"]);
let GpgEncryptFlags = dynamic(["--encrypt", "--recipient", "-r ", "-e "]);
let OutboundPgpAttachments = EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == "Outbound"
| join kind=inner (
    EmailAttachmentInfo
    | where Timestamp > ago(24h)
    | where FileName has_any (PgpExtensions)
  ) on NetworkMessageId
| extend RecipientDomain = tostring(split(RecipientEmailAddress, "@")[1])
| where RecipientDomain !in~ (InternalMailDomains);
// Signal 1: a single outbound email with an asymmetric-encrypted attachment sent to an external recipient
let PgpEmailExfil = OutboundPgpAttachments
| extend Actor = SenderFromAddress, Target = RecipientEmailAddress, Detail = FileName, Signal = "PgpEncryptedAttachmentOutbound", RiskScore = 80
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
// Signal 2: a burst of 3+ such emails from one sender within an hour — bulk staged exfiltration rather than a single ad hoc message
let BulkPgpAttachmentBurst = OutboundPgpAttachments
| summarize AttachmentCount = count(), UniqueRecipients = dcount(RecipientEmailAddress) by SenderFromAddress, bin(Timestamp, 1h)
| where AttachmentCount >= 3
| extend Actor = SenderFromAddress, Target = "(multiple)", Detail = strcat("AttachmentCount=", tostring(AttachmentCount), " UniqueRecipients=", tostring(UniqueRecipients)), Signal = "BulkPgpAttachmentBurst", RiskScore = 90
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
// Signal 3: GPG/GPG4Win/Kleopatra encryption invoked on an endpoint — the collection/encryption step that precedes the email send
let GpgEncryptRaw = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (GpgProcessNames)
| where ProcessCommandLine has_any (GpgEncryptFlags);
let GpgEncryptInvoked = GpgEncryptRaw
| extend Actor = DeviceName, Target = AccountName, Detail = ProcessCommandLine, Signal = "GpgEncryptInvoked", RiskScore = 55
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
// Signal 4: an external party's public key is imported into the local keyring within 15 minutes before it is used to encrypt data — just-in-time exfiltration prep, especially for a user with no prior PGP usage history
let KeyImportRaw = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (GpgProcessNames)
| where ProcessCommandLine has "--import"
| project ImportTime = Timestamp, DeviceName, AccountName;
let GpgKeyImportThenEncrypt = GpgEncryptRaw
| join kind=inner (KeyImportRaw) on DeviceName, AccountName
| where Timestamp - ImportTime between (0min .. 15min)
| extend Actor = DeviceName, Target = AccountName, Detail = ProcessCommandLine, Signal = "GpgKeyImportThenEncrypt", RiskScore = 70
| project Timestamp, Actor, Target, Detail, Signal, RiskScore;
union PgpEmailExfil, BulkPgpAttachmentBurst, GpgEncryptInvoked, GpgKeyImportThenEncrypt
| sort by RiskScore desc, Timestamp desc

Four-signal detection combining Microsoft Defender for Office 365 mail telemetry with Microsoft Defender for Endpoint process telemetry: (1) a single outbound email to an external domain carrying an attachment with a PGP/GPG or S/MIME extension (.gpg, .pgp, .asc, .p7m); (2) three or more such emails from the same sender within an hour, indicating bulk staged exfiltration; (3) GPG, GPG4Win, or Kleopatra invoked with encryption flags on an endpoint; (4) an external public key imported into the local GPG keyring within 15 minutes of that same key being used to encrypt data, a strong just-in-time exfiltration-prep indicator.

high severity medium confidence

Data Sources

Microsoft Defender for Office 365 (EmailEvents, EmailAttachmentInfo) Microsoft Defender for Endpoint (DeviceProcessEvents)

Required Tables

EmailEvents EmailAttachmentInfo DeviceProcessEvents

False Positives

Legitimate business use of PGP/GPG for signing or encrypting vendor communications, software release artifacts, or financial documents — build an allowlist of known business recipients/domains and users with a documented, recurring PGP usage pattern
Security or DevOps teams distributing GPG-encrypted credentials, API keys, or backup exports to external partners as an approved secrets-sharing workflow
Legal or compliance teams encrypting sensitive documents (M&A due diligence, privileged communications) for external counsel using S/MIME or PGP, which is expected and should be excluded once verified
Automated systems (CI/CD release signing, EDI/B2B integrations) that routinely invoke gpg.exe with --encrypt/--recipient as part of a scheduled, service-account-driven job

Splunk

spl

sourcetype="o365:management:activity" RecordType=DLPRuleMatch Workload=Exchange
| spath output=AttachmentExt path=AttachmentData{}.Extension
| search AttachmentExt IN ("gpg","pgp","asc","p7m")
| eval Actor=SenderAddress, Target=Recipients, Detail=AttachmentExt, Signal="PgpEncryptedAttachmentOutbound", RiskScore=80
| table _time Actor Target Detail Signal RiskScore
| append
    [ search sourcetype="o365:management:activity" RecordType=DLPRuleMatch Workload=Exchange
      | spath output=AttachmentExt path=AttachmentData{}.Extension
      | search AttachmentExt IN ("gpg","pgp","asc","p7m")
      | bin _time span=1h
      | stats count AS AttachmentCount, dc(Recipients) AS UniqueRecipients BY SenderAddress, _time
      | where AttachmentCount>=3
      | eval Actor=SenderAddress, Target="(multiple)", Detail="AttachmentCount=".AttachmentCount." UniqueRecipients=".UniqueRecipients, Signal="BulkPgpAttachmentBurst", RiskScore=90
      | table _time Actor Target Detail Signal RiskScore ]
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
      (Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\gpg4win*.exe" OR Image="*\\kleopatra.exe")
      (CommandLine="*--encrypt*" OR CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*-e *")
      | eval Actor=host, Target=User, Detail=CommandLine, Signal="GpgEncryptInvoked", RiskScore=55
      | table _time Actor Target Detail Signal RiskScore ]
| sort - RiskScore -_time

SPL detection combining Microsoft 365 DLP audit events (via the Splunk Add-on for Microsoft Office 365, RecordType=DLPRuleMatch on the Exchange workload) for outbound emails whose AttachmentData array contains a PGP/GPG or S/MIME extension, a burst threshold for 3+ such emails from one sender within an hour, and Sysmon process creation (EventCode=1) for GPG/GPG4Win/Kleopatra invoked with encryption flags.

high severity medium confidence

Data Sources

Microsoft 365 Management Activity API (DLP.All content type) via Splunk Add-on for Microsoft Office 365 Sysmon via Windows Event Log

Required Sourcetypes

o365:management:activity XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

Documented business use of PGP/S-MIME for vendor, legal, or financial correspondence — maintain an allowlist of verified recipient domains and known regular senders
CI/CD or release-signing pipelines that invoke gpg.exe with --encrypt/--recipient as a scheduled service-account job
Security teams distributing GPG-encrypted secrets or backup exports to external partners as an approved workflow

Elastic Security (EQL)

eql

sequence by process.entity_id with maxspan=10m
  [process where event.type == "start" and
    process.name : ("gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe") and
    process.command_line : ("*--encrypt*", "*--recipient*", "*-r *", "*-e *")
  ]
  [file where event.type in ("creation", "change") and
    file.extension : ("gpg", "pgp", "asc", "p7m")
  ]

Elastic EQL sequence correlating a GPG/GPG4Win/Kleopatra process invoked with encryption flags to the resulting output file it creates, matched via the shared process.entity_id of the encrypting process. Detects the on-host encryption step of the T1048.002 asymmetric-encrypted exfiltration pattern independent of the mail-flow signal, which is better covered by KQL/SPL against native email telemetry.

high severity medium confidence

Data Sources

Elastic Endpoint Security Elastic Agent (Endpoint Integration)

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.file-*

False Positives

Developers or release engineers routinely signing/encrypting build artifacts with GPG as part of a documented release process — allowlist the known service account or CI runner's process.entity_id lineage
Security teams encrypting credential exports or backup files with an internally-known key as an approved secrets-handling workflow

IBM QRadar (AQL)

sql

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    "Sender Address" AS SenderAddress,
    "Recipient Address" AS RecipientAddress,
    "Attachment Extension" AS AttachmentExtension,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    'PgpEncryptedAttachmentOutbound' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) = 'Microsoft Office 365'
  AND "Record Type" = 'DLPRuleMatch'
  AND "Workload" = 'Exchange'
  AND "Attachment Extension" IN ('gpg', 'pgp', 'asc', 'p7m')
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

QRadar AQL query over Microsoft 365 DLP audit events (ingested via the Office 365 DSM) detecting outbound Exchange messages whose DLP-extracted attachment metadata shows a PGP/GPG or S/MIME extension. Requires the 'Attachment Extension', 'Sender Address', 'Recipient Address', and 'Record Type' custom event properties to be extracted from the O365 Management Activity API payload.

high severity medium confidence

Data Sources

IBM QRadar SIEM Microsoft Office 365 (DLP.All content type via Management Activity API)

Required Tables

events

False Positives

Verified business partners, legal counsel, or financial correspondents that routinely receive PGP/S-MIME-encrypted attachments — suppress via a QRadar reference set of allowlisted sender/recipient-domain pairs
Automated release-signing or B2B integration jobs that send GPG-encrypted files to a known partner mailbox on a schedule

Sumo Logic CSE

sql

_sourceCategory="o365/management/activity" RecordType=DLPRuleMatch Workload=Exchange
| json field=_raw "AttachmentData" as AttachmentDataJson nodrop
| parse regex field=AttachmentDataJson "\"Extension\"\s*:\s*\"(?<AttachmentExt>[a-zA-Z0-9]+)\""
| where AttachmentExt matches "gpg" or AttachmentExt matches "pgp" or AttachmentExt matches "asc" or AttachmentExt matches "p7m"
| eval Signal="PgpEncryptedAttachmentOutbound", RiskScore=80
| fields _messagetime, SenderAddress, Recipients, AttachmentExt, Signal, RiskScore
| union (
    _sourceCategory="windows/sysmon" EventCode=1
    (Image matches "*\\gpg.exe" OR Image matches "*\\gpg2.exe" OR Image matches "*\\gpg4win*.exe" OR Image matches "*\\kleopatra.exe")
    (CommandLine matches "*--encrypt*" OR CommandLine matches "*--recipient*" OR CommandLine matches "*-r *" OR CommandLine matches "*-e *")
    | eval Signal="GpgEncryptInvoked", RiskScore=55
    | fields _messagetime, ComputerName, User, Image, CommandLine, Signal, RiskScore
  )
| sort by RiskScore desc

Sumo Logic search combining Microsoft 365 DLP audit events (Exchange workload, RecordType=DLPRuleMatch) parsed for PGP/GPG/S-MIME attachment extensions with Sysmon process creation (EventCode=1) for GPG/GPG4Win/Kleopatra invoked with encryption flags, unioned into a single ranked result set.

high severity medium confidence

Data Sources

Sumo Logic Cloud SIEM Microsoft 365 Management Activity API (via Sumo Logic O365 source) Windows Sysmon (via Sumo Logic Installed Collector)

Required Tables

_sourceCategory=o365/management/activity

False Positives

Verified business partners or legal/financial correspondents that routinely receive PGP/S-MIME-encrypted attachments — maintain a Sumo Logic lookup table of allowlisted sender/recipient-domain pairs
CI/CD release-signing jobs invoking gpg.exe with --encrypt on a schedule from a known build host

Google Chronicle / SecOps

yaral

rule pgp_encrypted_email_exfiltration {
  meta:
    author = "df00tech"
    description = "Detects outbound email carrying a PGP/GPG or S/MIME asymmetric-encrypted attachment sent to an external recipient"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1048.002"
    reference = "https://attack.mitre.org/techniques/T1048/002/"

  events:
    $email.metadata.event_type = "EMAIL_TRANSACTION"
    $email.network.email.direction = "OUTBOUND"
    re.regex($email.network.email.attachments.filename, `(?i)\.(gpg|pgp|asc|p7m)$`)

  match:
    $email.principal.user.userid over 1h

  condition:
    $email
}

Chronicle YARA-L 2.0 rule matching EMAIL_TRANSACTION UDM events with an outbound direction and an attachment filename ending in a PGP/GPG or S/MIME extension, aggregated per sending user over a one-hour window to also surface the bulk-burst pattern.

high severity medium confidence

Data Sources

Google Chronicle SIEM Chronicle UDM (Unified Data Model) — Email log ingestion (Microsoft 365 / Google Workspace)

Required Tables

UDM Events (EMAIL_TRANSACTION)

False Positives

Verified business partners or legal/financial correspondents that routinely receive PGP/S-MIME-encrypted attachments — maintain a Chronicle reference list of allowlisted sender/recipient-domain pairs and exclude matches
Automated release-signing or B2B integration jobs emailing GPG-encrypted files to a known partner mailbox on a schedule

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)\\(gpg|gpg2|gpg4win.*|kleopatra)\.exe$/
| CommandLine=/(?i)(--encrypt|--recipient|-r\s|-e\s)/
| Signal := "GpgEncryptInvoked"
| RiskScore := 55
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, Signal], function=[count(as=EventCount), max(field=RiskScore, as=MaxRisk)])
| sort(field=MaxRisk, order=desc)

CrowdStrike LogScale (Falcon) detection query using ProcessRollup2 endpoint telemetry to identify GPG, GPG4Win, or Kleopatra invoked with encryption flags — the on-host encryption step of the PGP/GPG asymmetric-encrypted exfiltration pattern. Should be paired with a follow-up query against Falcon's email-security or DLP integration (or the KQL/SPL EmailEvents-based signal) to confirm the encrypted output was subsequently emailed to an external recipient.

high severity medium confidence

Data Sources

CrowdStrike Falcon Endpoint Protection CrowdStrike LogScale Falcon ProcessRollup2 Telemetry

Required Tables

ProcessRollup2

False Positives

Developers or release engineers signing/encrypting build artifacts with GPG as part of a documented CI/CD release process — use Falcon host groups to tag known build infrastructure and exclude matching ComputerName values
Security teams encrypting credential exports or backup files with an internally-known recipient key as an approved workflow

Data Exfiltration via PGP/GPG-Encrypted Email Attachments

What is THREAT-PGPEmail-AsymmetricEncryptedExfil Data Exfiltration via PGP/GPG-Encrypted Email Attachments?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-PGPEmail-AsymmetricEncryptedExfil

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (2)

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

What is THREAT-PGPEmail-AsymmetricEncryptedExfil Data Exfiltration via PGP/GPG-Encrypted Email Attachments?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-PGPEmail-AsymmetricEncryptedExfil

Testing Methodology

Unlock playbooks & atomic tests with Pro

Related Detections

Tactic Hub

Detection Variants (2)

Parent Technique

Related Techniques

Same Tactic: Exfiltration

Popular Detections

Get new detections in your inbox