Veeam Backup Database Suspicious Query

Title: Veeam Backup Database Suspicious Query
Status: test
Description:Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
References:
  -https://labs.withsecure.com/publications/fin7-target-veeam-servers
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
modified:None
Tags:

• -'attack.collection'
• -'attack.t1005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_sql:
    Image|endswith: '\sqlcmd.exe'
    CommandLine|contains|all:
      -'VeeamBackup'
      -'From '

  selection_db:
    CommandLine|contains:
      -'BackupRepositories'
      -'Backups'
      -'Credentials'
      -'HostCreds'
      -'SmbFileShares'
      -'Ssh_creds'
      -'VSphereInfo'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium