PUA - Restic Backup Tool Execution

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services. If not legitimately used in the enterprise environment, its presence may indicate malicious activity.

Known false positives

Legitimate use of Restic for backup purposes within the organization.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1048` Exfiltration Over Alternative Protocol `T1567.002` Exfiltration Over Web Service: Exfiltration to Cloud Storage

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: PUA - Restic Backup Tool Execution
id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
status: experimental
description: |
    Detects the execution of the Restic backup tool, which can be used for data exfiltration.
    Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
    If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
references:
    - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
    - https://restic.net/
    - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-17
tags:
    - attack.exfiltration
    - attack.t1048
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific:
        - CommandLine|contains|all:
              - '--password-file'
              - 'init'
              - ' -r '
        - CommandLine|contains|all:
              - '--use-fs-snapshot'
              - 'backup'
              - ' -r '
    selection_restic:
        CommandLine|contains:
            - 'sftp:'
            - 'rest:http'
            - 's3:s3.'
            - 's3.http'
            - 'azure:'
            - ' gs:'
            - 'rclone:'
            - 'swift:'
            - ' b2:'
        CommandLine|contains|all:
            - ' init '
            - ' -r '
    condition: 1 of selection_*
falsepositives:
    - Legitimate use of Restic for backup purposes within the organization.
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_specific`

selection_specific:
    - CommandLine|contains|all:
          - '--password-file'
          - 'init'
          - ' -r '
    - CommandLine|contains|all:
          - '--use-fs-snapshot'
          - 'backup'
          - ' -r '

Stage 2: `selection_restic`

selection_restic:
    CommandLine|contains:
        - 'sftp:'
        - 'rest:http'
        - 's3:s3.'
        - 's3.http'
        - 'azure:'
        - ' gs:'
        - 'rclone:'
        - 'swift:'
        - ' b2:'
    CommandLine|contains|all:
        - ' init '
        - ' -r '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-r` corpus 10 (sigma 10) `b2:` `gs:` `init` `--password-file` `--use-fs-snapshot` `azure:` `backup` corpus 6 (sigma 5, splunk 1) `init` `rclone:` `rest:http` `s3.http` `s3:s3.` `sftp:` `swift:`	`field:"CommandLine" kind:match`