Windows Process Execution: Restic Backup Tool Command-Line Indicators

title: "Windows Process Execution: Restic Backup Tool Command-Line Indicators"
id: 37bc439b-74e9-46cc-82f7-24fbc25816ad
status: experimental
description: This rule identifies execution of the Restic backup tool by matching specific command-line patterns related to repository initialization and backup operations. Restic can be used to stage and exfiltrate sensitive data to remote storage backends, so unexpected usage in an enterprise environment may indicate malicious activity. It relies on Windows process creation telemetry with command-line fields to determine whether Restic is invoked with characteristic arguments and remote repository targets.
references:
  - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
  - https://restic.net/
  - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_restic.yml
author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-17
tags:
  - attack.exfiltration
  - attack.t1048
  - attack.t1567.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_specific:
    - CommandLine|contains|all:
        - --password-file
        - init
        - " -r "
    - CommandLine|contains|all:
        - --use-fs-snapshot
        - backup
        - " -r "
  selection_restic:
    CommandLine|contains:
      - "sftp:"
      - rest:http
      - s3:s3.
      - s3.http
      - "azure:"
      - " gs:"
      - "rclone:"
      - "swift:"
      - " b2:"
    CommandLine|contains|all:
      - " init "
      - " -r "
  condition: 1 of selection_*
falsepositives:
  - Legitimate use of Restic for backup purposes within the organization.
level: high
license: DRL-1.1
related:
  - id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
    type: derived