Detection rules › Sigma

Suspicious Child Process Of Veeam Dabatase

Status
test
Severity
critical
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessNo specific technique
PersistenceNo specific technique
Privilege EscalationNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Suspicious Child Process Of Veeam Dabatase
id: d55b793d-f847-4eea-b59a-5ab09908ac90
related:
    - id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445
      type: similar
status: test
description: Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.
references:
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\sqlservr.exe'
        ParentCommandLine|contains: 'VEEAMSQL'
    selection_child_1:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wsl.exe'
            - '\wt.exe'
        CommandLine|contains:
            - '-ex '
            - 'bypass'
            - 'cscript'
            - 'DownloadString'
            - 'http://'
            - 'https://'
            - 'mshta'
            - 'regsvr32'
            - 'rundll32'
            - 'wscript'
            - 'copy '
    selection_child_2:
        Image|endswith:
            - '\net.exe'
            - '\net1.exe'
            - '\netstat.exe'
            - '\nltest.exe'
            - '\ping.exe'
            - '\tasklist.exe'
            - '\whoami.exe'
    condition: selection_parent and 1 of selection_child_*
level: critical

Stages and Predicates

Stage 0: condition

selection_parent and 1 of selection_child_*

Stage 1: selection_parent

selection_parent:
    ParentImage|endswith: '\sqlservr.exe'
    ParentCommandLine|contains: 'VEEAMSQL'

Stage 2: selection_child_1

selection_child_1:
    Image|endswith:
        - '\cmd.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wsl.exe'
        - '\wt.exe'
    CommandLine|contains:
        - '-ex '
        - 'bypass'
        - 'cscript'
        - 'DownloadString'
        - 'http://'
        - 'https://'
        - 'mshta'
        - 'regsvr32'
        - 'rundll32'
        - 'wscript'
        - 'copy '

Stage 3: selection_child_2

selection_child_2:
    Image|endswith:
        - '\net.exe'
        - '\net1.exe'
        - '\netstat.exe'
        - '\nltest.exe'
        - '\ping.exe'
        - '\tasklist.exe'
        - '\whoami.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -ex
  • DownloadString corpus 8 (sigma 7, kusto 1)
  • bypass corpus 6 (sigma 6)
  • copy corpus 12 (sigma 11, chronicle 1)
  • cscript corpus 15 (sigma 15)
  • http:// corpus 21 (sigma 18, elastic 1, splunk 1, kusto 1)
  • https:// corpus 21 (sigma 18, elastic 1, splunk 1, kusto 1)
  • mshta corpus 14 (sigma 14)
  • regsvr32 corpus 15 (sigma 15)
  • rundll32 corpus 26 (sigma 23, chronicle 2, kusto 1)
  • wscript corpus 16 (sigma 16)
Imageends_with
  • \cmd.exe corpus 130 (sigma 130)
  • \net.exe corpus 49 (sigma 49)
  • \net1.exe corpus 47 (sigma 47)
  • \netstat.exe corpus 5 (sigma 5)
  • \nltest.exe corpus 9 (sigma 9)
  • \ping.exe corpus 7 (sigma 7)
  • \powershell.exe corpus 182 (sigma 182)
  • \pwsh.exe corpus 168 (sigma 168)
  • \tasklist.exe corpus 5 (sigma 5)
  • \whoami.exe corpus 19 (sigma 19)
  • \wsl.exe corpus 11 (sigma 11)
  • \wt.exe corpus 5 (sigma 5)
ParentCommandLinematch
  • VEEAMSQL
ParentImageends_with
  • \sqlservr.exe corpus 3 (sigma 3)