Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil.
Upgrade to ProDetect Data Exfiltration via PGP/GPG-Encrypted Email Attachments in Elastic Security
Rather than pushing data to attacker-controlled infrastructure over SFTP/FTPS/HTTP (the channel used by purpose-built tools like StealBit and Exmatter), this sub-technique variant abuses a fully sanctioned, already-allowed corporate channel — outbound email through the organization's own mail server or SaaS mail platform (Exchange Online, Gmail) — by first encrypting the data with an asymmetric keypair (OpenPGP/GPG, or S/MIME) before attaching it. Because the ciphertext is opaque without the recipient's private key, content-based DLP, CASB, and email security gateways that rely on pattern/keyword/fingerprint matching over attachment contents cannot inspect what is being sent; they can only observe metadata (attachment extension, size, sender, recipient domain). This makes it an attractive technique for insiders exfiltrating IP to a personal or competitor mailbox, and has also been observed as a secondary channel by data-theft actors who encrypt staged archives with a public key before transfer specifically to prevent the victim organization, EDR/DLP vendor, or law enforcement from ever recovering the plaintext of what was stolen. Detection therefore has to pivot on the artifacts still visible around the encryption event: unusual attachment extensions (.gpg, .pgp, .asc, .p7m) or ASCII-armored PGP blocks, GPG/GPG4Win/Kleopatra process execution with encryption flags on a host with no prior legitimate PGP usage, importing an external party's public key immediately before using it, and bursts of such encrypted-attachment emails to external domains that exceed a single user's normal PGP-for-legitimate-purposes baseline (e.g., signing software releases, encrypting vendor communications).
MITRE ATT&CK
- Tactic
- Exfiltration
Elastic Detection Query
sequence by process.entity_id with maxspan=10m
[process where event.type == "start" and
process.name : ("gpg.exe", "gpg2.exe", "gpg4win.exe", "kleopatra.exe") and
process.command_line : ("*--encrypt*", "*--recipient*", "*-r *", "*-e *")
]
[file where event.type in ("creation", "change") and
file.extension : ("gpg", "pgp", "asc", "p7m")
]Elastic EQL sequence correlating a GPG/GPG4Win/Kleopatra process invoked with encryption flags to the resulting output file it creates, matched via the shared process.entity_id of the encrypting process. Detects the on-host encryption step of the T1048.002 asymmetric-encrypted exfiltration pattern independent of the mail-flow signal, which is better covered by KQL/SPL against native email telemetry.
Data Sources
Required Tables
False Positives & Tuning
- Developers or release engineers routinely signing/encrypting build artifacts with GPG as part of a documented release process — allowlist the known service account or CI runner's process.entity_id lineage
- Security teams encrypting credential exports or backup files with an internally-known key as an approved secrets-handling workflow
Other platforms for THREAT-PGPEmail-AsymmetricEncryptedExfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate GPG Encryption of a Staged Archive with an External Recipient Key
Expected signal: Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.
- Test 2Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient
Expected signal: EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.
- Test 3Simulate a Bulk Burst of PGP-Encrypted Attachment Emails
Expected signal: Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.
- Test 4Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite
Expected signal: Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.