VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Title: VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Status: test
Description:Detects dump of credentials in VeeamBackup dbo
References:
  -https://thedfirreport.com/2021/12/13/diavol-ransomware/
  -https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html
Author: frack113
Date: 2021-12-20
modified:2023-02-13
Tags:

• -'attack.collection'
• -'attack.t1005'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_tools:
    Image|endswith: '\sqlcmd.exe'
  selection_query:
    CommandLine|contains|all:
      -'SELECT'
      -'TOP'
      -'[VeeamBackup].[dbo].[Credentials]'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high