PUA - Restic Backup Tool Execution

Hunt Hypothesis

Detects the execution of the Restic backup tool, which can be used for data exfiltration. Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, includ

Detection Rule

Sigma (Original)

title: PUA - Restic Backup Tool Execution
id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
status: experimental
description: |
    Detects the execution of the Restic backup tool, which can be used for data exfiltration.
    Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
    If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
references:
    - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
    - https://restic.net/
    - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-17
tags:
    - attack.exfiltration
    - attack.t1048
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific:
        - CommandLine|contains|all:
              - '--password-file'
              - 'init'
              - ' -r '
        - CommandLine|contains|all:
              - '--use-fs-snapshot'
              - 'backup'
              - ' -r '
    selection_restic:
        CommandLine|contains:
            - 'sftp:'
            - 'rest:http'
            - 's3:s3.'
            - 's3.http'
            - 'azure:'
            - ' gs:'
            - 'rclone:'
            - 'swift:'
            - ' b2:'
        CommandLine|contains|all:
            - ' init '
            - ' -r '
    condition: 1 of selection_*
falsepositives:
    - Legitimate use of Restic for backup purposes within the organization.
level: high

KQL (Azure Sentinel)

imProcessCreate
| where ((TargetProcessCommandLine contains "--password-file" and TargetProcessCommandLine contains "init" and TargetProcessCommandLine contains " -r ") or (TargetProcessCommandLine contains "--use-fs-snapshot" and TargetProcessCommandLine contains "backup" and TargetProcessCommandLine contains " -r ")) or ((TargetProcessCommandLine contains "sftp:" or TargetProcessCommandLine contains "rest:http" or TargetProcessCommandLine contains "s3:s3." or TargetProcessCommandLine contains "s3.http" or TargetProcessCommandLine contains "azure:" or TargetProcessCommandLine contains " gs:" or TargetProcessCommandLine contains "rclone:" or TargetProcessCommandLine contains "swift:" or TargetProcessCommandLine contains " b2:") and (TargetProcessCommandLine contains " init " and TargetProcessCommandLine contains " -r "))

Required Data Sources

False Positive Guidance

• Legitimate use of Restic for backup purposes within the organization.

MITRE ATT&CK Context

• Tactic: Exfiltration
• Technique: T1048 — T1048
• Technique: T1567.002 — T1567.002

References

• https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
• https://restic.net/
• https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
• SigmaHQ Rule