PGP Block Extraction from CMD/PowerShell

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•5

Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".