Windows Process Execution: Restic Backup Tool Command-Line Indicators

Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-10-17
Updated: 2026-07-30

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048Exfiltration Over Alternative Protocol
- T1567.002Exfiltration to Cloud Storage
Impact

What it detects

This rule identifies execution of the Restic backup tool by matching specific command-line patterns related to repository initialization and backup operations. Restic can be used to stage and exfiltrate sensitive data to remote storage backends, so unexpected usage in an enterprise environment may indicate malicious activity. It relies on Windows process creation telemetry with command-line fields to determine whether Restic is invoked with characteristic arguments and remote repository targets.

Reporting behind it

Related detections9 linkedT1567.002 — drag to rearrange

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

Data Exfiltration to WebDAV Share via curl Upload

Suspicious ALPHA SPIDER Rclone Exfiltration Tool Masquerading as System Binary (via process_creation)

Malicious GhostLocker2 C2 Communication via HTTP POST (via proxy)

Suspicious Rclone Exfiltration Masquerading as wininit.exe

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Rclone SMB Share Exfiltration

Suspicious Data Exfiltration via Rclone to Cloud Storage (via process_creation)

Windows Process Execution: Restic Backup Tool Command-Line Indicators

Pivot detection · T1567.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-restic-backup-tool-command-line-indicators-6ddff2e8

title: "Windows Process Execution: Restic Backup Tool Command-Line Indicators"
id: 37bc439b-74e9-46cc-82f7-24fbc25816ad
status: experimental
description: This rule identifies execution of the Restic backup tool by matching specific command-line patterns related to repository initialization and backup operations. Restic can be used to stage and exfiltrate sensitive data to remote storage backends, so unexpected usage in an enterprise environment may indicate malicious activity. It relies on Windows process creation telemetry with command-line fields to determine whether Restic is invoked with characteristic arguments and remote repository targets.
references:
  - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
  - https://restic.net/
  - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_restic.yml
author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-17
tags:
  - attack.exfiltration
  - attack.t1048
  - attack.t1567.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_specific:
    - CommandLine|contains|all:
        - --password-file
        - init
        - " -r "
    - CommandLine|contains|all:
        - --use-fs-snapshot
        - backup
        - " -r "
  selection_restic:
    CommandLine|contains:
      - "sftp:"
      - rest:http
      - s3:s3.
      - s3.http
      - "azure:"
      - " gs:"
      - "rclone:"
      - "swift:"
      - " b2:"
    CommandLine|contains|all:
      - " init "
      - " -r "
  condition: 1 of selection_*
falsepositives:
  - Legitimate use of Restic for backup purposes within the organization.
level: high
license: DRL-1.1
related:
  - id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL