Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil.
Upgrade to ProDetect Data Exfiltration via PGP/GPG-Encrypted Email Attachments in IBM QRadar
Rather than pushing data to attacker-controlled infrastructure over SFTP/FTPS/HTTP (the channel used by purpose-built tools like StealBit and Exmatter), this sub-technique variant abuses a fully sanctioned, already-allowed corporate channel — outbound email through the organization's own mail server or SaaS mail platform (Exchange Online, Gmail) — by first encrypting the data with an asymmetric keypair (OpenPGP/GPG, or S/MIME) before attaching it. Because the ciphertext is opaque without the recipient's private key, content-based DLP, CASB, and email security gateways that rely on pattern/keyword/fingerprint matching over attachment contents cannot inspect what is being sent; they can only observe metadata (attachment extension, size, sender, recipient domain). This makes it an attractive technique for insiders exfiltrating IP to a personal or competitor mailbox, and has also been observed as a secondary channel by data-theft actors who encrypt staged archives with a public key before transfer specifically to prevent the victim organization, EDR/DLP vendor, or law enforcement from ever recovering the plaintext of what was stolen. Detection therefore has to pivot on the artifacts still visible around the encryption event: unusual attachment extensions (.gpg, .pgp, .asc, .p7m) or ASCII-armored PGP blocks, GPG/GPG4Win/Kleopatra process execution with encryption flags on a host with no prior legitimate PGP usage, importing an external party's public key immediately before using it, and bursts of such encrypted-attachment emails to external domains that exceed a single user's normal PGP-for-legitimate-purposes baseline (e.g., signing software releases, encrypting vendor communications).
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
"Sender Address" AS SenderAddress,
"Recipient Address" AS RecipientAddress,
"Attachment Extension" AS AttachmentExtension,
LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
'PgpEncryptedAttachmentOutbound' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) = 'Microsoft Office 365'
AND "Record Type" = 'DLPRuleMatch'
AND "Workload" = 'Exchange'
AND "Attachment Extension" IN ('gpg', 'pgp', 'asc', 'p7m')
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500QRadar AQL query over Microsoft 365 DLP audit events (ingested via the Office 365 DSM) detecting outbound Exchange messages whose DLP-extracted attachment metadata shows a PGP/GPG or S/MIME extension. Requires the 'Attachment Extension', 'Sender Address', 'Recipient Address', and 'Record Type' custom event properties to be extracted from the O365 Management Activity API payload.
Data Sources
Required Tables
False Positives & Tuning
- Verified business partners, legal counsel, or financial correspondents that routinely receive PGP/S-MIME-encrypted attachments — suppress via a QRadar reference set of allowlisted sender/recipient-domain pairs
- Automated release-signing or B2B integration jobs that send GPG-encrypted files to a known partner mailbox on a schedule
Other platforms for THREAT-PGPEmail-AsymmetricEncryptedExfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate GPG Encryption of a Staged Archive with an External Recipient Key
Expected signal: Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.
- Test 2Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient
Expected signal: EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.
- Test 3Simulate a Bulk Burst of PGP-Encrypted Attachment Emails
Expected signal: Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.
- Test 4Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite
Expected signal: Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.