{"id":"696bfb54-227e-4602-ac5b-30d9d2053312","title":"Veeam Backup Database Suspicious Query","description":"Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-04","modified":"","tags":["attack.collection","attack.t1005"],"technique_ids":["T1005"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"source_path":"rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml","source_sha256":"f7644919c9462220b04dbc783b3282ac817f219b27bb1d650779694f4fbf24bf","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Veeam Backup Database Suspicious Query\nid: 696bfb54-227e-4602-ac5b-30d9d2053312\nstatus: test\ndescription: Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.\nreferences:\n    - https://labs.withsecure.com/publications/fin7-target-veeam-servers\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-04\ntags:\n    - attack.collection\n    - attack.t1005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_sql:\n        Image|endswith: '\\sqlcmd.exe'\n        CommandLine|contains|all:\n            - 'VeeamBackup'\n            - 'From '\n    selection_db:\n        CommandLine|contains:\n            - 'BackupRepositories'\n            - 'Backups'\n            - 'Credentials'\n            - 'HostCreds'\n            - 'SmbFileShares'\n            - 'Ssh_creds'\n            - 'VSphereInfo'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1005","id":"T1005","name":"Data from Local System","page":"techniques/enterprise/T1005/"}],"data_path":"data/detection-rules/696bfb54-227e-4602-ac5b-30d9d2053312.json","kind":"sigma"}