detection.wiki

Detection rules › Sigma

VeeamBackup Database Credentials Dump Via Sqlcmd.EXE

Status
test
Severity
high
Log source
category process_creation, product windows
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects dump of credentials in VeeamBackup dbo

MITRE ATT&CK coverage

TacticTechniques
Collection

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation
Security-AuditingEvent ID 4688: A new process has been created.

Rule body

title: VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
id: b57ba453-b384-4ab9-9f40-1038086b4e53
status: test
description: Detects dump of credentials in VeeamBackup dbo
references:
    - https://thedfirreport.com/2021/12/13/diavol-ransomware/
    - https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html
author: frack113
date: 2021-12-20
modified: 2023-02-13
tags:
    - attack.collection
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        Image|endswith: '\sqlcmd.exe'
    selection_query:
        CommandLine|contains|all:
            - 'SELECT'
            - 'TOP'
            - '[VeeamBackup].[dbo].[Credentials]'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_tools

selection_tools:
    Image|endswith: '\sqlcmd.exe'

Stage 2: selection_query

selection_query:
    CommandLine|contains|all:
        - 'SELECT'
        - 'TOP'
        - '[VeeamBackup].[dbo].[Credentials]'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • SELECT corpus 4 (sigma 4)
  • TOP corpus 2 (sigma 2)
  • [VeeamBackup].[dbo].[Credentials]
field:"CommandLine" kind:match
Imageends_with
  • \sqlcmd.exe corpus 5 (sigma 5)
field:"Image" kind:ends_with value:"\sqlcmd.exe"