Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil.
Upgrade to ProDetect Data Exfiltration via PGP/GPG-Encrypted Email Attachments in CrowdStrike LogScale
Rather than pushing data to attacker-controlled infrastructure over SFTP/FTPS/HTTP (the channel used by purpose-built tools like StealBit and Exmatter), this sub-technique variant abuses a fully sanctioned, already-allowed corporate channel — outbound email through the organization's own mail server or SaaS mail platform (Exchange Online, Gmail) — by first encrypting the data with an asymmetric keypair (OpenPGP/GPG, or S/MIME) before attaching it. Because the ciphertext is opaque without the recipient's private key, content-based DLP, CASB, and email security gateways that rely on pattern/keyword/fingerprint matching over attachment contents cannot inspect what is being sent; they can only observe metadata (attachment extension, size, sender, recipient domain). This makes it an attractive technique for insiders exfiltrating IP to a personal or competitor mailbox, and has also been observed as a secondary channel by data-theft actors who encrypt staged archives with a public key before transfer specifically to prevent the victim organization, EDR/DLP vendor, or law enforcement from ever recovering the plaintext of what was stolen. Detection therefore has to pivot on the artifacts still visible around the encryption event: unusual attachment extensions (.gpg, .pgp, .asc, .p7m) or ASCII-armored PGP blocks, GPG/GPG4Win/Kleopatra process execution with encryption flags on a host with no prior legitimate PGP usage, importing an external party's public key immediately before using it, and bursts of such encrypted-attachment emails to external domains that exceed a single user's normal PGP-for-legitimate-purposes baseline (e.g., signing software releases, encrypting vendor communications).
MITRE ATT&CK
- Tactic
- Exfiltration
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ImageFileName=/(?i)\\(gpg|gpg2|gpg4win.*|kleopatra)\.exe$/
| CommandLine=/(?i)(--encrypt|--recipient|-r\s|-e\s)/
| Signal := "GpgEncryptInvoked"
| RiskScore := 55
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, Signal], function=[count(as=EventCount), max(field=RiskScore, as=MaxRisk)])
| sort(field=MaxRisk, order=desc)CrowdStrike LogScale (Falcon) detection query using ProcessRollup2 endpoint telemetry to identify GPG, GPG4Win, or Kleopatra invoked with encryption flags — the on-host encryption step of the PGP/GPG asymmetric-encrypted exfiltration pattern. Should be paired with a follow-up query against Falcon's email-security or DLP integration (or the KQL/SPL EmailEvents-based signal) to confirm the encrypted output was subsequently emailed to an external recipient.
Data Sources
Required Tables
False Positives & Tuning
- Developers or release engineers signing/encrypting build artifacts with GPG as part of a documented CI/CD release process — use Falcon host groups to tag known build infrastructure and exclude matching ComputerName values
- Security teams encrypting credential exports or backup files with an internally-known recipient key as an approved workflow
Other platforms for THREAT-PGPEmail-AsymmetricEncryptedExfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate GPG Encryption of a Staged Archive with an External Recipient Key
Expected signal: Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.
- Test 2Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient
Expected signal: EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.
- Test 3Simulate a Bulk Burst of PGP-Encrypted Attachment Emails
Expected signal: Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.
- Test 4Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite
Expected signal: Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.