All Detections

Portable Gpg.EXE Execution

avatar
SigmaHQ Detections@sigmaHQ
updated Jun 4, 2025000

Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Sigma