Renamed Gpg.EXE Execution
Detects the execution of the 'gpg.exe' utility when its filename has been changed. Adversaries, particularly ransomware and loaders, often rename legitimate tools like GnuPG to evade detection while using them for encryption or decryption operations.
Sigma
