Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil.
Upgrade to ProDetect Data Exfiltration via PGP/GPG-Encrypted Email Attachments in Splunk
Rather than pushing data to attacker-controlled infrastructure over SFTP/FTPS/HTTP (the channel used by purpose-built tools like StealBit and Exmatter), this sub-technique variant abuses a fully sanctioned, already-allowed corporate channel — outbound email through the organization's own mail server or SaaS mail platform (Exchange Online, Gmail) — by first encrypting the data with an asymmetric keypair (OpenPGP/GPG, or S/MIME) before attaching it. Because the ciphertext is opaque without the recipient's private key, content-based DLP, CASB, and email security gateways that rely on pattern/keyword/fingerprint matching over attachment contents cannot inspect what is being sent; they can only observe metadata (attachment extension, size, sender, recipient domain). This makes it an attractive technique for insiders exfiltrating IP to a personal or competitor mailbox, and has also been observed as a secondary channel by data-theft actors who encrypt staged archives with a public key before transfer specifically to prevent the victim organization, EDR/DLP vendor, or law enforcement from ever recovering the plaintext of what was stolen. Detection therefore has to pivot on the artifacts still visible around the encryption event: unusual attachment extensions (.gpg, .pgp, .asc, .p7m) or ASCII-armored PGP blocks, GPG/GPG4Win/Kleopatra process execution with encryption flags on a host with no prior legitimate PGP usage, importing an external party's public key immediately before using it, and bursts of such encrypted-attachment emails to external domains that exceed a single user's normal PGP-for-legitimate-purposes baseline (e.g., signing software releases, encrypting vendor communications).
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
sourcetype="o365:management:activity" RecordType=DLPRuleMatch Workload=Exchange
| spath output=AttachmentExt path=AttachmentData{}.Extension
| search AttachmentExt IN ("gpg","pgp","asc","p7m")
| eval Actor=SenderAddress, Target=Recipients, Detail=AttachmentExt, Signal="PgpEncryptedAttachmentOutbound", RiskScore=80
| table _time Actor Target Detail Signal RiskScore
| append
[ search sourcetype="o365:management:activity" RecordType=DLPRuleMatch Workload=Exchange
| spath output=AttachmentExt path=AttachmentData{}.Extension
| search AttachmentExt IN ("gpg","pgp","asc","p7m")
| bin _time span=1h
| stats count AS AttachmentCount, dc(Recipients) AS UniqueRecipients BY SenderAddress, _time
| where AttachmentCount>=3
| eval Actor=SenderAddress, Target="(multiple)", Detail="AttachmentCount=".AttachmentCount." UniqueRecipients=".UniqueRecipients, Signal="BulkPgpAttachmentBurst", RiskScore=90
| table _time Actor Target Detail Signal RiskScore ]
| append
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\gpg.exe" OR Image="*\\gpg2.exe" OR Image="*\\gpg4win*.exe" OR Image="*\\kleopatra.exe")
(CommandLine="*--encrypt*" OR CommandLine="*--recipient*" OR CommandLine="*-r *" OR CommandLine="*-e *")
| eval Actor=host, Target=User, Detail=CommandLine, Signal="GpgEncryptInvoked", RiskScore=55
| table _time Actor Target Detail Signal RiskScore ]
| sort - RiskScore -_timeSPL detection combining Microsoft 365 DLP audit events (via the Splunk Add-on for Microsoft Office 365, RecordType=DLPRuleMatch on the Exchange workload) for outbound emails whose AttachmentData array contains a PGP/GPG or S/MIME extension, a burst threshold for 3+ such emails from one sender within an hour, and Sysmon process creation (EventCode=1) for GPG/GPG4Win/Kleopatra invoked with encryption flags.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Documented business use of PGP/S-MIME for vendor, legal, or financial correspondence — maintain an allowlist of verified recipient domains and known regular senders
- CI/CD or release-signing pipelines that invoke gpg.exe with --encrypt/--recipient as a scheduled service-account job
- Security teams distributing GPG-encrypted secrets or backup exports to external partners as an approved workflow
Other platforms for THREAT-PGPEmail-AsymmetricEncryptedExfil
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate GPG Encryption of a Staged Archive with an External Recipient Key
Expected signal: Sysmon Event ID 1 for gpg.exe invoked with --quick-generate-key, --import, and --encrypt --recipient; Sysmon Event ID 11 for creation of test_pubkey.asc and staged_data.txt.gpg.
- Test 2Simulate Outbound Email of a PGP-Encrypted Attachment to an External Test Recipient
Expected signal: EmailEvents record with EmailDirection=Outbound to the external test recipient; EmailAttachmentInfo record with FileName ending in .gpg.
- Test 3Simulate a Bulk Burst of PGP-Encrypted Attachment Emails
Expected signal: Four EmailAttachmentInfo/DLP records within the same one-hour bin, each with a .gpg attachment from the same sender to external recipients.
- Test 4Simulate GPG4Win/Kleopatra Encryption on macOS via GPG Suite
Expected signal: Endpoint process telemetry (EDR/Sysmon-for-Mac equivalent) for gpg invoked with --encrypt --recipient flags, and file-creation telemetry for staged_data.txt.gpg.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-PGPEmail-AsymmetricEncryptedExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month
Related Detections
Tactic Hub
Detection Variants (2)
Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.