Potential Veeam Credential Access Command

  1[metadata]
  2creation_date = "2024/03/14"
  3integration = ["windows", "endpoint", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies commands that can access and decrypt Veeam credentials stored in MSSQL databases. Attackers can use Veeam
 11Credentials to target backups as part of destructive operations such as Ransomware attacks.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27name = "Potential Veeam Credential Access Command"
 28note = """## Triage and analysis
 29
 30> **Disclaimer**:
 31> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 32
 33### Investigating Potential Veeam Credential Access Command
 34
 35Veeam credentials stored in MSSQL databases are crucial for managing backup operations. Attackers may exploit tools like `sqlcmd.exe` or PowerShell commands to access and decrypt these credentials, potentially leading to data breaches or ransomware attacks. The detection rule identifies suspicious command executions targeting Veeam credentials, focusing on specific processes and arguments, to alert analysts of potential credential access attempts.
 36
 37### Possible investigation steps
 38
 39- Review the process execution details to confirm the presence of sqlcmd.exe or PowerShell commands like Invoke-Sqlcmd, focusing on the process.name and process.args fields.
 40- Examine the command line arguments for any references to [VeeamBackup].[dbo].[Credentials] to determine if there was an attempt to access or decrypt Veeam credentials.
 41- Check the user account associated with the process execution to assess if it is a legitimate user or potentially compromised.
 42- Investigate the source host for any signs of unauthorized access or suspicious activity, such as unusual login times or failed login attempts.
 43- Correlate the alert with other security events or logs from data sources like Microsoft Defender XDR or Sysmon to identify any related malicious activities or patterns.
 44- Assess the risk and impact by determining if any Veeam credentials were successfully accessed or exfiltrated, and evaluate the potential for data breaches or ransomware attacks.
 45
 46### False positive analysis
 47
 48- Routine database maintenance tasks may trigger the rule if they involve accessing Veeam credentials for legitimate purposes. To manage this, identify and document regular maintenance schedules and exclude these activities from triggering alerts.
 49- Automated scripts used for backup verification or testing might use similar commands. Review and whitelist these scripts by their process names or specific arguments to prevent unnecessary alerts.
 50- Internal security audits or compliance checks that involve credential access could be mistaken for malicious activity. Coordinate with audit teams to schedule these activities and create exceptions for known audit processes.
 51- Development or testing environments where Veeam credentials are accessed for non-production purposes can generate false positives. Implement environment-specific exclusions to differentiate between production and non-production activities.
 52- Legitimate use of PowerShell commands for database management by authorized personnel may be flagged. Maintain a list of authorized users and their typical command patterns to refine the detection rule and reduce false positives.
 53
 54### Response and remediation
 55
 56- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
 57- Terminate any suspicious processes identified by the alert, such as `sqlcmd.exe` or PowerShell commands accessing Veeam credentials.
 58- Change all Veeam-related credentials stored in the MSSQL database to prevent further unauthorized access using compromised credentials.
 59- Conduct a thorough review of recent backup operations and logs to identify any unauthorized access or modifications.
 60- Escalate the incident to the security operations center (SOC) for further investigation and to determine if additional systems are compromised.
 61- Implement enhanced monitoring on systems storing Veeam credentials to detect similar suspicious activities in the future.
 62- Review and update access controls and permissions for MSSQL databases to ensure only authorized personnel have access to Veeam credentials."""
 63references = ["https://thedfirreport.com/2021/12/13/diavol-ransomware/"]
 64risk_score = 47
 65rule_id = "b661f86d-1c23-4ce7-a59e-2edbdba28247"
 66severity = "medium"
 67tags = [
 68    "Domain: Endpoint",
 69    "OS: Windows",
 70    "Use Case: Threat Detection",
 71    "Tactic: Defense Evasion",
 72    "Tactic: Credential Access",
 73    "Data Source: Elastic Endgame",
 74    "Data Source: Elastic Defend",
 75    "Data Source: Windows Security Event Logs",
 76    "Data Source: Microsoft Defender XDR",
 77    "Data Source: Sysmon",
 78    "Data Source: SentinelOne",
 79    "Data Source: Crowdstrike",
 80    "Resources: Investigation Guide",
 81    "Noise: Low",
 82    "Performance: Normal",
 83    "Rule Type: Event Correlation (EQL)",
 84    "Platform: Windows",
 85]
 86timestamp_override = "event.ingested"
 87type = "eql"
 88
 89query = '''
 90process where host.os.type == "windows" and event.type == "start" and
 91  (
 92    (process.name : "sqlcmd.exe" or ?process.pe.original_file_name : "sqlcmd.exe") or
 93    process.args : ("Invoke-Sqlcmd", "Invoke-SqlExecute", "Invoke-DbaQuery", "Invoke-SqlQuery")
 94  ) and
 95  process.args : "*[VeeamBackup].[dbo].[Credentials]*"
 96'''
 97
 98setup = """## Setup
 99
100This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
101
102Setup instructions: https://ela.st/install-elastic-defend
103
104### Additional data sources
105
106This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
107
108- [CrowdStrike](https://ela.st/crowdstrike-integration)
109- [Microsoft Defender XDR](https://ela.st/m365-defender)
110- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
111- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
112- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
113"""
114
115
116[[rule.threat]]
117framework = "MITRE ATT&CK"
118
119[[rule.threat.technique]]
120id = "T1003"
121name = "OS Credential Dumping"
122reference = "https://attack.mitre.org/techniques/T1003/"
123
124[[rule.threat.technique]]
125id = "T1555"
126name = "Credentials from Password Stores"
127reference = "https://attack.mitre.org/techniques/T1555/"
128
129[rule.threat.tactic]
130id = "TA0006"
131name = "Credential Access"
132reference = "https://attack.mitre.org/tactics/TA0006/"
133
134[[rule.threat]]
135framework = "MITRE ATT&CK"
136
137[[rule.threat.technique]]
138id = "T1059"
139name = "Command and Scripting Interpreter"
140reference = "https://attack.mitre.org/techniques/T1059/"
141
142[[rule.threat.technique.subtechnique]]
143id = "T1059.001"
144name = "PowerShell"
145reference = "https://attack.mitre.org/techniques/T1059/001/"
146
147[rule.threat.tactic]
148id = "TA0002"
149name = "Execution"
150reference = "https://attack.mitre.org/tactics/TA0002/"
151
152[[rule.threat]]
153framework = "MITRE ATT&CK"
154
155[[rule.threat.technique]]
156id = "T1213"
157name = "Data from Information Repositories"
158reference = "https://attack.mitre.org/techniques/T1213/"
159
160[rule.threat.tactic]
161id = "TA0009"
162name = "Collection"
163reference = "https://attack.mitre.org/tactics/TA0009/"