Windows PowerShell Credential Dumping via Veeam.Backup.Common.ProtectedStorage

Alerts on PowerShell scripts that reference Veeam protected storage and credential extraction indicators, enabling stored credential dumping on Windows.

FreeUnreviewedSigmahighv1

windows-powershell-credential-dumping-via-veeam-backup-common-protectedstorage-976d6e6f

title: Windows PowerShell Credential Dumping via Veeam.Backup.Common.ProtectedStorage
id: 4b66fdd5-89b9-4372-9060-fe12fd5c13d2
status: test
description: This rule flags PowerShell script execution where the script block text includes a Veeam protected storage credential access sequence and supporting strings such as Invoke-Sqlcmd and the Veeam Backup product name. Attackers can use this pattern to extract stored credentials from Veeam backup server components, enabling further access and lateral movement. The detection relies on Windows PowerShell script block text telemetry containing the specified literals in the executed script.
references:
  - https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.credential-access
logsource:
  product: windows
  category: ps_script
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection:
    ScriptBlockText|contains|all:
      - "[Credentials]"
      - "[Veeam.Backup.Common.ProtectedStorage]::GetLocalString"
      - Invoke-Sqlcmd
      - Veeam Backup and Replication
  condition: selection
falsepositives:
  - Administrators backup scripts (must be investigated)
level: high
license: DRL-1.1
related:
  - id: 976d6e6f-a04b-4900-9713-0134a353e38b
    type: derived

What it detects

This rule flags PowerShell script execution where the script block text includes a Veeam protected storage credential access sequence and supporting strings such as Invoke-Sqlcmd and the Veeam Backup product name. Attackers can use this pattern to extract stored credentials from Veeam backup server components, enabling further access and lateral movement. The detection relies on Windows PowerShell script block text telemetry containing the specified literals in the executed script.

Known false positives

Administrators backup scripts (must be investigated)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.