File encrypted with a symmetric cipher on the command line

1title: File encrypted with a symmetric cipher on the command line2id: 9fe7b63a-a4ac-4299-bcb4-f7a7d40cdff53status: experimental4description: |5  A match is the encryption step alone. This rule sees no protocol, no6  destination and no transferred byte, so a hit is not by itself evidence that7  anything left the host, and because the same subcommands also decrypt, an8  inbound file being unpacked matches identically to data being staged for9  exfiltration. What it does detect is the manual symmetric step AN1390 pairs10  with an outbound transfer — `openssl enc` or the bare `openssl <cipher>`11  shorthand, `gpg --symmetric` or `gpg -c`, or an explicit AES, RC4, 3DES or12  ChaCha20 algorithm name — which is the half of the analytic a single13  process-creation event can carry; Sigma has no cross-event window, so MITRE's14  FileTransferIndicator knob has no form in the rule and the transfer leg must15  be confirmed from network telemetry before a hit means exfiltration rather16  than local file encryption. The cipher-name selection deliberately carries no17  process anchor so that a renamed binary or a wrapper script still matches on18  the algorithm string, at the cost of matching any command line that names a19  cipher, including TLS and VPN configuration. Written against the20  `process_creation` category for Linux, whose `CommandLine` field is a21  normalised join of the auditd SYSCALL and EXECVE records — a raw auditd feed22  keeps the arguments in a separate EXECVE record and needs that mapping23  applied before this rule can match at all.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0503, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1048/00127  - https://attack.mitre.org/detectionstrategies/DET050328author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.exfiltration32  - attack.t1048.00133logsource:34  category: process_creation35  product: linux36detection:37  selection_openssl:38    Image|endswith: '/openssl'39    CommandLine|contains: ' enc'40  selection_gpg:41    Image|endswith:42      - '/gpg'43      - '/gpg1'44      - '/gpg2'45    CommandLine|contains:46      - '--symmetric'47      - '--cipher-algo'48      - ' -c '49  selection_cipher_name:50    CommandLine|contains:51      - 'aes-128-cbc'52      - 'aes-192-cbc'53      - 'aes-256-cbc'54      - 'aes-256-ctr'55      - 'aes-256-gcm'56      - '-aes128'57      - '-aes192'58      - '-aes256'59      - 'chacha20'60      - '-des3'61      - '-rc4'62      - ' rc4 '63  condition: selection_openssl or selection_gpg or selection_cipher_name64falsepositives:65  - "Container entrypoints and cloud-init provisioning that unseal a bundled config at start-up with openssl enc -d -aes-256-cbc. On any containerised estate this fires on every container start and every autoscaling event and is the loudest match by a wide margin, which is what the level below reflects."66  - "Backup and database-export scripts that pipe a dump through openssl enc -aes-256-cbc before shipping it off the host, on a schedule and on every server, where only the destination separates the event from staged exfiltration. Pin the allowed script path and account rather than dropping the cipher terms."67  - "Configuration-management and CI pipelines that seal or unseal a secrets file at deploy time with openssl enc or gpg --symmetric, producing a match on every build agent on every deployment."68  - "Users protecting a document with a passphrase before sending it to an external party, which is the intended purpose of gpg --symmetric, and support staff decrypting one that arrived the same way."69  - "Command lines that name a cipher without encrypting a file at all, such as curl, openvpn or stunnel invocations pinning an AES or ChaCha20 suite, and distribution package builds or regression suites that walk every cipher in the list within a single job."70level: low