Attempted Veeam Database Credential Dump (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Operators from the Diavol ransomware gang were observed using sqlcmd to extract encrypted credentials from Veeam databases that were decrypted using a publicly documented technique on Veeam's R+D forums. This use case detects commands targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented cases, the logic is not reliant on detecting sqlcmd.exe to account for instances where the binary has been renamed or another utility was used to interact with the database

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.001` Unsecured Credentials: Credentials In Files

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '25095.46537'
title: Attempted Veeam Database Credential Dump
description: 'Operators from the Diavol ransomware gang were observed using sqlcmd
  to extract encrypted credentials from Veeam databases that were decrypted using
  a publicly documented technique on Veeam''s R+D forums. This use case detects commands
  targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented
  cases, the logic is not reliant on detecting sqlcmd.exe to account for instances
  where the binary has been renamed or another utility was used to interact with the
  database. -- Threat Actor Association: UTA0178 -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]"
  | table _time, host, user, user, process, process_*, parent_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- PowerShell logs
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]"

Stage 2: `table`

| table _time, host, user, user, process, process_*, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4104<"`
1	`"SELECT"`
1	`"[user_name]"`
1	`"[password]"`
1	`"FROM"`
1	`"[VeeamBackup].[dbo].[Credentials]"`