Windows PowerShell Credential Dumping Script Targeting Veeam Backup ProtectedStorage
Alerts on PowerShell scripts that reference Veeam protected storage and credential extraction indicators, enabling stored credential dumping on Windows.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-04
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell script block content that includes Veeam Backup credential retrieval artifacts, specifically calls to the Veeam.Backup.Common.ProtectedStorage GetLocalString method along with credential-related markers and SQL invocation. Attackers can use this pattern to extract locally protected credentials from Veeam backup servers to enable further access. It relies on Windows PowerShell script block telemetry that records the script text being executed.
Reporting behind it
- pwndefend.comhttps://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/
- labs.withsecure.comhttps://labs.withsecure.com/publications/fin7-target-veeam-servers
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Credential Dumping Script Targeting Veeam Backup ProtectedStorage
id: 4b66fdd5-89b9-4372-9060-fe12fd5c13d2
status: test
description: This rule flags PowerShell script block content that includes Veeam Backup credential retrieval artifacts, specifically calls to the Veeam.Backup.Common.ProtectedStorage GetLocalString method along with credential-related markers and SQL invocation. Attackers can use this pattern to extract locally protected credentials from Veeam backup servers to enable further access. It relies on Windows PowerShell script block telemetry that records the script text being executed.
references:
- https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
- attack.credential-access
logsource:
product: windows
category: ps_script
definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
selection:
ScriptBlockText|contains|all:
- "[Credentials]"
- "[Veeam.Backup.Common.ProtectedStorage]::GetLocalString"
- Invoke-Sqlcmd
- Veeam Backup and Replication
condition: selection
falsepositives:
- Administrators backup scripts (must be investigated)
level: high
license: DRL-1.1
related:
- id: 976d6e6f-a04b-4900-9713-0134a353e38b
type: derived