Sigma rule: Suspicious Child Process Of Veeam Dabatase

Rule

Title

Suspicious Child Process Of Veeam Dabatase

Status

test

Level

critical

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-05-04

File

rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Log source

product

windows

category

process_creation

Detection

selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
    ParentCommandLine|contains: 'VEEAMSQL'
selection_child_1:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wsl.exe'
        - '\wt.exe'
    CommandLine|contains:
        - '-ex '
        - 'bypass'
        - 'cscript'
        - 'DownloadString'
        - 'http://'
        - 'https://'
        - 'mshta'
        - 'regsvr32'
        - 'rundll32'
        - 'wscript'
        - 'copy '
selection_child_2:
    Image|endswith:
        - '\net.exe'
        - '\net1.exe'
        - '\netstat.exe'
        - '\nltest.exe'
        - '\ping.exe'
        - '\tasklist.exe'
        - '\whoami.exe'
condition: selection_parent and 1 of selection_child_*

Tags

• attack.initial-access
• attack.persistence
• attack.privilege-escalation

Related rules

• 869b9ca7-9ea2-4a5a-8325-e80e62f75445 (similar)

References

• https://labs.withsecure.com/publications/fin7-target-veeam-servers

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml