Gpg4win File Encryption/Decryption in Suspicious Locations
This rule detects the use of Gpg4win (gpg.exe or gpg2.exe) to encrypt or decrypt files. The detection specifically triggers when the command line includes the '-passphrase' argument and the file being operated on is located in suspicious directories such as 'PerfLogs', 'Temp', 'Users\Public', 'Windows\Temp', 'AppData\Local\Temp', or 'AppData\Roaming'. This behavior can indicate an adversary encrypting collected data before exfiltration or using these common staging areas for malicious operations.
Sigma
