THREAT-PGPEmail-AsymmetricEncryptedExfil Elastic Security · Elastic

Detect Data Exfiltration via PGP/GPG-Encrypted Email Attachments in Elastic Security

Rather than pushing data to attacker-controlled infrastructure over SFTP/FTPS/HTTP (the channel used by purpose-built tools like StealBit and Exmatter), this sub-technique variant abuses a fully sanctioned, already-allowed corporate channel — outbound email through the organization's own mail server or SaaS mail platform (Exchange Online, Gmail) — by first encrypting the data with an asymmetric keypair (OpenPGP/GPG, or S/MIME) before attaching it. Because the ciphertext is opaque without the recipient's private key, content-based DLP, CASB, and email security gateways that rely on pattern/keyword/fingerprint matching over attachment contents cannot inspect what is being sent; they can only observe metadata (attachment extension, size, sender, recipient domain). This makes it an attractive technique for insiders exfiltrating IP to a personal or competitor mailbox, and has also been observed as a secondary channel by data-theft actors who encrypt staged archives with a public key before transfer specifically to prevent the victim organization, EDR/DLP vendor, or law enforcement from ever recovering the plaintext of what was stolen. Detection therefore has to pivot on the artifacts still visible around the encryption event: unusual attachment extensions (.gpg, .pgp, .asc, .p7m) or ASCII-armored PGP blocks, GPG/GPG4Win/Kleopatra process execution with encryption flags on a host with no prior legitimate PGP usage, importing an external party's public key immediately before using it, and bursts of such encrypted-attachment emails to external domains that exceed a single user's normal PGP-for-legitimate-purposes baseline (e.g., signing software releases, encrypting vendor communications).

MITRE ATT&CK

Tactic
Exfiltration

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by process.entity_id with maxspan=10m
  [process where event.type == "start" and
    process.name : ("gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe") and
    process.command_line : ("*--encrypt*", "*--recipient*", "*-r *", "*-e *")
  ]
  [file where event.type in ("creation", "change") and
    file.extension : ("gpg", "pgp", "asc", "p7m")
  ]
high severity medium confidence

Elastic EQL sequence correlating a GPG/GPG4Win/Kleopatra process invoked with encryption flags to the resulting output file it creates, matched via the shared process.entity_id of the encrypting process. Detects the on-host encryption step of the T1048.002 asymmetric-encrypted exfiltration pattern independent of the mail-flow signal, which is better covered by KQL/SPL against native email telemetry.

Data Sources

Elastic Endpoint SecurityElastic Agent (Endpoint Integration)

Required Tables

logs-endpoint.events.process-*logs-endpoint.events.file-*

False Positives & Tuning

  • Developers or release engineers routinely signing/encrypting build artifacts with GPG as part of a documented release process — allowlist the known service account or CI runner's process.entity_id lineage
  • Security teams encrypting credential exports or backup files with an internally-known key as an approved secrets-handling workflow

Other platforms for THREAT-PGPEmail-AsymmetricEncryptedExfil

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate GPG Encryption of a Staged Archive with an External Recipient Key

    Expected signal: Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.

  2. Test 2Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient

    Expected signal: EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.

  3. Test 3Simulate a Bulk Burst of PGP-Encrypted Attachment Emails

    Expected signal: Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.

  4. Test 4Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite

    Expected signal: Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.

Last updated: 2026-07-21 Research depth: deep
References (3)

Response Playbook

Triage

  1. Identify the sender, recipient domain, and attachment extension. Confirm whether the recipient domain is a known business partner, personal webmail (Gmail, ProtonMail, Outlook.com), or an unfamiliar domain — personal webmail recipients are the highest-signal indicator of insider IP theft.
  2. Check whether the sending account has any prior legitimate history of PGP/GPG usage (signing releases, encrypting vendor files). A first-time GPG invocation on a host, especially one belonging to a user in a role with access to sensitive IP (engineering, finance, M&A), is a strong anomaly.
  3. Pull DeviceProcessEvents/Sysmon Event ID 1 for the sending host in the hour preceding the email to look for the GpgEncryptInvoked or GpgKeyImportThenEncrypt signal — this confirms local encryption occurred on this device rather than the attachment arriving pre-encrypted from elsewhere.
  4. If a key import is present, extract the imported public key's user ID/email and compare it against the outbound email's recipient — a match strongly confirms the recipient's own key was used to encrypt data specifically for them.
  5. Check DeviceFileEvents/Sysmon Event ID 11 in the same window for creation of large archives (.zip, .7z, .tar) immediately before the .gpg/.pgp/.asc/.p7m file appears — this identifies what was staged and encrypted, and its approximate size/scope.
  6. Because content-based DLP cannot see inside the ciphertext, do not assume no sensitive data classification match means no sensitive data was sent — treat the metadata signal (extension, sender, external recipient) as authoritative on its own.

Containment

  1. If the sender is an active or recently departed employee, suspend outbound mail sending capability and disable the account pending investigation, particularly for burst/bulk signals.
  2. Quarantine the message in the mail flow if it has not yet left the tenant (Exchange Online transport rule / mail flow rule can hold matching attachments for review); if already delivered, this becomes a legal/HR matter rather than a technical containment action.
  3. Preserve the endpoint (do not wipe/reimage) — the local GPG keyring, encrypted source files, and process history are the primary evidence for what was sent and to whom.
  4. If a key import for an unfamiliar external identity is confirmed alongside encryption of business-critical files, treat this as a probable insider-threat case and engage HR/Legal before taking any account-level action that the employee would notice.

Evidence Collection

  1. The exact attachment filename, extension, size, and SHA256 hash from EmailAttachmentInfo/DLP logs, and the sender/recipient/timestamp of the message.
  2. The local GPG keyring contents (public keys imported, their associated email/user ID and import timestamp) via `gpg --list-keys` if the endpoint is still accessible, or the equivalent Sysmon/EDR process command-line history.
  3. Any pre-encryption archive or file staging activity (DeviceFileEvents/Sysmon Event ID 11) in the window before the .gpg/.pgp/.asc/.p7m file was created, to determine the scope of what was collected.
  4. Full process command-line and parent process chain for the gpg.exe/gpg4win/kleopatra invocation, to distinguish manual user action from a scripted/automated encryption step.
  5. Mail flow/transport logs confirming successful delivery (not just a send attempt) to the external recipient.

Escalation Criteria

  • !The recipient domain is a personal webmail provider or a domain with no documented business relationship with the organization.
  • !The sender has access to material non-public information, source code, customer PII, or trade secrets, and no prior legitimate PGP usage baseline exists for that user.
  • !A key import for an external identity is directly followed by encryption and email of a large or sensitive archive — treat as high-confidence intentional exfiltration and involve HR/Legal immediately.
  • !The burst signal (3+ encrypted-attachment emails within an hour) fires for a user who has resigned, been placed on a PIP, or is otherwise a known flight/insider-risk indicator per HR.

Investigation Guide

Related Techniques

T1048 — Exfiltration Over Alternative Protocol (parent technique)T1048.003 — Exfiltration Over Unencrypted Non-C2 Protocol (the SMTP-exfil sibling sub-technique, distinguished here by the payload itself being asymmetrically encrypted rather than sent in the clear)T1560 — Archive Collected Data (the staging/archiving step that frequently precedes GPG encryption of the archive)T1114.003 — Email Forwarding Rule (an alternative, mailbox-side exfiltration technique that does not require local encryption)T1029 — Scheduled Transfer (bulk/burst sending of multiple encrypted emails can resemble a scheduled or scripted transfer pattern)

Forensic Artifacts

  • >EmailAttachmentInfo/DLP AttachmentData records showing the encrypted attachment's filename, extension, and hash
  • >Local GPG keyring database (pubring.kbx/pubring.gpg) and its modification timestamp, showing when an external key was imported
  • >Sysmon Event ID 1/DeviceProcessEvents for the gpg.exe, gpg2.exe, gpg4win.exe, or kleopatra.exe process launch and full command line
  • >Sysmon Event ID 11/DeviceFileEvents for the creation of the source archive and the resulting .gpg/.pgp/.asc/.p7m output file
  • >Mail transport/message-trace logs confirming final delivery status and timestamp for the outbound message

Tuning Guidance

Signal 1 (single encrypted attachment to an external domain) is the noisiest signal and will fire on legitimate vendor/legal/financial PGP correspondence — the false-positive rate drops sharply once a per-user, per-recipient-domain allowlist is built from the 30-day baseline hunting query above. Signal 2 (bulk burst) and Signal 4 (key import immediately before encryption) are substantially higher-fidelity and should be prioritized for alerting; Signal 4 in particular has very few legitimate causes outside of a scheduled automation job, since a human importing a stranger's key and immediately using it to encrypt data is not typical day-to-day PGP usage. Tune the burst threshold (default 3/hour) down for users in high-sensitivity roles (R&D, M&A, finance) and up for teams with a documented, high-volume legitimate PGP workflow (e.g., a security team that routinely emails encrypted credential exports).

Hunting Queries

Baseline hunt across the last 30 days for every user account that has invoked GPG/GPG4Win/Kleopatra with encryption flags, independent of any email signal — used to build the per-user PGP usage baseline referenced throughout triage, and to surface first-time users of the tool who warrant closer review.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe")
| where ProcessCommandLine has_any ("--encrypt", "--recipient", "-r ", "-e ")
| summarize FirstSeen = min(Timestamp), Invocations = count(), Hosts = make_set(DeviceName) by AccountName
| sort by FirstSeen asc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\gpg4win*.exe" OR Image="*\\kleopatra.exe")
  (CommandLine="*--encrypt*" OR CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*-e *")
| stats earliest(_time) AS FirstSeen, count AS Invocations, values(host) AS Hosts BY User
| sort FirstSeen

Atomic Red Team Tests

Test 1 Simulate GPG Encryption of a Staged Archive with an External Recipient Key
windows

Generates a test GPG keypair representing an external recipient, imports its public key, and uses it to encrypt a dummy archive, simulating the on-host encryption step (Signal 3/4) that precedes emailing stolen data. Use only synthetic, non-sensitive test data.

Command

powershell 
"dummy sensitive content" | Out-File C:\Temp\staged_data.txt; gpg --batch --yes --passphrase '' --quick-generate-key [email protected] default default; gpg --export --armor [email protected] > C:\Temp\test_pubkey.asc; gpg --import C:\Temp\test_pubkey.asc; gpg --batch --yes --trust-model always --encrypt --recipient [email protected] --output C:\Temp\staged_data.txt.gpg C:\Temp\staged_data.txt

Cleanup

powershell 
Remove-Item C:\Temp\staged_data.txt, C:\Temp\staged_data.txt.gpg, C:\Temp\test_pubkey.asc -Force -ErrorAction SilentlyContinue; gpg --batch --yes --delete-keys [email protected] 2>$null

Expected Telemetry

Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.

Expected Detection

GpgEncryptInvoked (RiskScore=55) fires on the --encrypt invocation, and GpgKeyImportThenEncrypt (RiskScore=70) fires because the --import and --encrypt commands occur on the same host/account within the 15-minute correlation window.

Test 2 Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient
windows

Sends a test email with a .gpg attachment to an external test mailbox using an approved test tenant, simulating the mail-flow side of the detection (Signal 1). Use only a controlled test mailbox you own — never a real third-party address.

Command

powershell 
Send-MailMessage -From 'test-user@<YOUR_TEST_TENANT>' -To '<TEST_EXTERNAL_RECIPIENT>' -Subject 'Detection Test - PGP Attachment' -Body 'Automated detection engineering test' -Attachments 'C:\Temp\staged_data.txt.gpg' -SmtpServer '<TEST_SMTP_RELAY>'

Cleanup

powershell 
Remove-Item C:\Temp\staged_data.txt.gpg -Force -ErrorAction SilentlyContinue

Expected Telemetry

EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.

Expected Detection

PgpEncryptedAttachmentOutbound (RiskScore=80) fires on the outbound email carrying the .gpg attachment to the external recipient domain.

Test 3 Simulate a Bulk Burst of PGP-Encrypted Attachment Emails
linux

Repeats the encrypted-attachment email send four times within a short window to the same or different external test recipients, simulating bulk staged exfiltration (Signal 2).

Command

bash 
for i in 1 2 3 4; do gpg --batch --yes --trust-model always --encrypt --recipient [email protected] --output /tmp/staged_$i.txt.gpg /tmp/staged_data.txt; echo 'Automated detection engineering test' | mail -s "Detection Test $i" -A /tmp/staged_$i.txt.gpg <TEST_EXTERNAL_RECIPIENT>; done

Cleanup

bash 
rm -f /tmp/staged_*.txt.gpg

Expected Telemetry

Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.

Expected Detection

BulkPgpAttachmentBurst (RiskScore=90) fires once AttachmentCount reaches the 3-per-hour threshold for the sending account.

Test 4 Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite
macos

Uses the command-line GPG Suite tooling on macOS to encrypt a dummy file with a test recipient key, validating that the endpoint signal (Signal 3) generalizes across platforms rather than being Windows-specific.

Command

bash 
echo 'dummy sensitive content' > /tmp/staged_data.txt; gpg --batch --yes --passphrase '' --quick-generate-key [email protected] default default; gpg --batch --yes --trust-model always --encrypt --recipient [email protected] --output /tmp/staged_data.txt.gpg /tmp/staged_data.txt

Cleanup

bash 
rm -f /tmp/staged_data.txt /tmp/staged_data.txt.gpg; gpg --batch --yes --delete-keys [email protected] 2>/dev/null

Expected Telemetry

Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.

Expected Detection

GpgEncryptInvoked (RiskScore=55) fires on the --encrypt invocation regardless of host operating system.

Related Detections

Tactic Hub

TA0010Exfiltration

Detection Variants (3)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Parent Technique

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Related Techniques

T1048Exfiltration Over Alternative ProtocolT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolT1560Archive Collected DataT1114.003Email Forwarding RuleT1029Scheduled Transfer

Same Tactic: Exfiltration

Popular Detections