File Decryption Using Gpg4win
This rule detects the use of Gpg4win's gpg.exe or gpg2.exe for file decryption. It specifically looks for command-line arguments that include both '-d' (for decrypt) and 'passphrase', indicating an attempt to decrypt a file using a passphrase. This activity can be indicative of malicious actors decrypting sensitive data or malware components.
Sigma
