Detection rules › Splunk
Attempted Veeam Database Credential Dump (Sysmon)
Operators from the Diavol ransomware gang were observed using sqlcmd to extract encrypted credentials from Veeam databases that were decrypted using a publicly documented technique on Veeam's R+D forums. This use case detects commands targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented cases, the logic is not reliant on detecting sqlcmd.exe to account for instances where the binary has been renamed or another utility was used to interact with the database
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '25095.46534'
title: Attempted Veeam Database Credential Dump
description: 'Operators from the Diavol ransomware gang were observed using sqlcmd
to extract encrypted credentials from Veeam databases that were decrypted using
a publicly documented technique on Veeam''s R+D forums. This use case detects commands
targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented
cases, the logic is not reliant on detecting sqlcmd.exe to account for instances
where the binary has been renamed or another utility was used to interact with the
database. -- Threat Actor Association: UTA0178 -- Software Association: Akira'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]" |
table _time, host, user, user, process, process_*, parent_* | bin span=1s | stats
values(*) as * by _time, host '
techniques:
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2021/12/13/diavol-ransomware/
- https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "SELECT" "[user_name]" "[password]" "FROM" "[VeeamBackup].[dbo].[Credentials]"
Stage 2: table
| table _time, host, user, user, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | "SELECT" |
| 1 | "[user_name]" |
| 1 | "[password]" |
| 1 | "FROM" |
| 1 | "[VeeamBackup].[dbo].[Credentials]" |