Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil.
Upgrade to ProDetect Data Exfiltration via PGP/GPG-Encrypted Email Attachments in Google Chronicle
Rather than pushing data to attacker-controlled infrastructure over SFTP/FTPS/HTTP (the channel used by purpose-built tools like StealBit and Exmatter), this sub-technique variant abuses a fully sanctioned, already-allowed corporate channel — outbound email through the organization's own mail server or SaaS mail platform (Exchange Online, Gmail) — by first encrypting the data with an asymmetric keypair (OpenPGP/GPG, or S/MIME) before attaching it. Because the ciphertext is opaque without the recipient's private key, content-based DLP, CASB, and email security gateways that rely on pattern/keyword/fingerprint matching over attachment contents cannot inspect what is being sent; they can only observe metadata (attachment extension, size, sender, recipient domain). This makes it an attractive technique for insiders exfiltrating IP to a personal or competitor mailbox, and has also been observed as a secondary channel by data-theft actors who encrypt staged archives with a public key before transfer specifically to prevent the victim organization, EDR/DLP vendor, or law enforcement from ever recovering the plaintext of what was stolen. Detection therefore has to pivot on the artifacts still visible around the encryption event: unusual attachment extensions (.gpg, .pgp, .asc, .p7m) or ASCII-armored PGP blocks, GPG/GPG4Win/Kleopatra process execution with encryption flags on a host with no prior legitimate PGP usage, importing an external party's public key immediately before using it, and bursts of such encrypted-attachment emails to external domains that exceed a single user's normal PGP-for-legitimate-purposes baseline (e.g., signing software releases, encrypting vendor communications).
MITRE ATT&CK
- Tactic
- Exfiltration
YARA-L Detection Query
rule pgp_encrypted_email_exfiltration {
meta:
author = "df00tech"
description = "Detects outbound email carrying a PGP/GPG or S/MIME asymmetric-encrypted attachment sent to an external recipient"
severity = "HIGH"
mitre_attack_tactic = "Exfiltration"
mitre_attack_technique = "T1048.002"
reference = "https://attack.mitre.org/techniques/T1048/002/"
events:
$email.metadata.event_type = "EMAIL_TRANSACTION"
$email.network.email.direction = "OUTBOUND"
re.regex($email.network.email.attachments.filename, `(?i)\.(gpg|pgp|asc|p7m)$`)
match:
$email.principal.user.userid over 1h
condition:
$email
}Chronicle YARA-L 2.0 rule matching EMAIL_TRANSACTION UDM events with an outbound direction and an attachment filename ending in a PGP/GPG or S/MIME extension, aggregated per sending user over a one-hour window to also surface the bulk-burst pattern.
Data Sources
Required Tables
False Positives & Tuning
- Verified business partners or legal/financial correspondents that routinely receive PGP/S-MIME-encrypted attachments — maintain a Chronicle reference list of allowlisted sender/recipient-domain pairs and exclude matches
- Automated release-signing or B2B integration jobs emailing GPG-encrypted files to a known partner mailbox on a schedule
Other platforms for THREAT-PGPEmail-AsymmetricEncryptedExfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate GPG Encryption of a Staged Archive with an External Recipient Key
Expected signal: Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.
- Test 2Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient
Expected signal: EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.
- Test 3Simulate a Bulk Burst of PGP-Encrypted Attachment Emails
Expected signal: Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.
- Test 4Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite
Expected signal: Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.