OpenSSL Data Encryption Activity by TeamPCP

Brandon Rodriguez@BMRodriguez

•updated Mar 25, 2026•5•0•141

Detects the specific OpenSSL command line arguments used by TeamPCP to encrypt stolen credentials before exfiltration. This rule looks for executions of 'openssl' with AES-256 encryption flags ('enc -aes-256-cbc' or 'enc -aes-256') and the use of a file to pass the encryption password ('-pass file:').