Windows Process: sqlcmd.exe Querying Veeam Backup Databases

title: "Windows Process: sqlcmd.exe Querying Veeam Backup Databases"
id: 82f7d495-0254-4827-b04e-df4298b541de
status: test
description: This rule identifies Windows process executions of sqlcmd.exe that issue SQL queries against Veeam backup database objects. Attackers may use direct database querying to collect sensitive configuration or credential-related information from exposed backup repositories. The detection relies on process creation telemetry, matching sqlcmd.exe execution paths and command-line arguments containing Veeam database context markers.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_sql:
    Image|endswith: \sqlcmd.exe
    CommandLine|contains|all:
      - VeeamBackup
      - "From "
  selection_db:
    CommandLine|contains:
      - BackupRepositories
      - Backups
      - Credentials
      - HostCreds
      - SmbFileShares
      - Ssh_creds
      - VSphereInfo
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 696bfb54-227e-4602-ac5b-30d9d2053312
    type: derived