Windows Process Execution: Restic Backup Tool Command-Line Indicators
Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.
- Product
- windows
- Category
- process_creation
- Author
- Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-10-17
- Updated
- 2026-07-30
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Impact
What it detects
This rule identifies execution of the Restic backup tool by matching specific command-line patterns related to repository initialization and backup operations. Restic can be used to stage and exfiltrate sensitive data to remote storage backends, so unexpected usage in an enterprise environment may indicate malicious activity. It relies on Windows process creation telemetry with command-line fields to determine whether Restic is invoked with characteristic arguments and remote repository targets.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
- restic.nethttps://restic.net/
- restic.readthedocs.iohttps://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_restic.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Execution: Restic Backup Tool Command-Line Indicators"
id: 37bc439b-74e9-46cc-82f7-24fbc25816ad
status: experimental
description: This rule identifies execution of the Restic backup tool by matching specific command-line patterns related to repository initialization and backup operations. Restic can be used to stage and exfiltrate sensitive data to remote storage backends, so unexpected usage in an enterprise environment may indicate malicious activity. It relies on Windows process creation telemetry with command-line fields to determine whether Restic is invoked with characteristic arguments and remote repository targets.
references:
- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
- https://restic.net/
- https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_restic.yml
author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-17
tags:
- attack.exfiltration
- attack.t1048
- attack.t1567.002
logsource:
product: windows
category: process_creation
detection:
selection_specific:
- CommandLine|contains|all:
- --password-file
- init
- " -r "
- CommandLine|contains|all:
- --use-fs-snapshot
- backup
- " -r "
selection_restic:
CommandLine|contains:
- "sftp:"
- rest:http
- s3:s3.
- s3.http
- "azure:"
- " gs:"
- "rclone:"
- "swift:"
- " b2:"
CommandLine|contains|all:
- " init "
- " -r "
condition: 1 of selection_*
falsepositives:
- Legitimate use of Restic for backup purposes within the organization.
level: high
license: DRL-1.1
related:
- id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
type: derived