Veeam Backup Database Suspicious Query (via process_creation)

title: Veeam Backup Database Suspicious Query (via process_creation)
id: 2420fdc2-c5f0-5d19-bdff-fc72e8edd5eb
status: stable
description: This rule detects potentially anomalous SQL queries using SQLCmd targeting the Veeam backup databases to steal information.
references:
    - https://attack.mitre.org/techniques/T1005/
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Huntrule Team
date: 2026-06-03
tags:
    - attack.collection
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection_sql:
        Image|endswith: '\sqlcmd.exe'
        CommandLine|contains|all:
            - 'VeeamBackup'
            - 'From '
    selection_db:
        CommandLine|contains:
            - 'BackupRepositories'
            - 'Backups'
            - 'Credentials'
            - 'HostCreds'
            - 'SmbFileShares'
            - 'Ssh_creds'
            - 'VSphereInfo'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium