Detection rules › Splunk
Attempted Veeam Database Credential Dump (Sysmon)
Operators from the Diavol ransomware gang were observed using sqlcmd to extract encrypted credentials from Veeam databases that were decrypted using a publicly documented technique on Veeam's R+D forums. This use case detects commands targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented cases, the logic is not reliant on detecting sqlcmd.exe to account for instances where the binary has been renamed or another utility was used to interact with the database
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1552.001 Unsecured Credentials: Credentials In Files |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '25095.46534'
title: Attempted Veeam Database Credential Dump
description: 'Operators from the Diavol ransomware gang were observed using sqlcmd
to extract encrypted credentials from Veeam databases that were decrypted using
a publicly documented technique on Veeam''s R+D forums. This use case detects commands
targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented
cases, the logic is not reliant on detecting sqlcmd.exe to account for instances
where the binary has been renamed or another utility was used to interact with the
database. -- Threat Actor Association: UTA0178 -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]" |
table _time, host, user, user, process, process_*, parent_* | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]"
Stage 2: table
| table _time, host, user, user, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "SELECT" |
| 1 | "[user_name]" |
| 1 | "[password]" |
| 1 | "FROM" |
| 1 | "[VeeamBackup].[dbo].[Credentials]" |