Windows sqlcmd.exe Credential Dump Query Against VeeamBackup dbo

title: Windows sqlcmd.exe Credential Dump Query Against VeeamBackup dbo
id: 598af1b8-2e6f-42db-8bbf-28bfbf4dda7c
status: test
description: This rule flags process executions of sqlcmd.exe where the command line contains a SQL query selecting the TOP rows from the VeeamBackup dbo Credentials table. Such credential-dumping activity matters because it enables attackers to obtain sensitive backup database secrets, often as a step toward further compromise. Detection relies on Windows process creation telemetry capturing the sqlcmd.exe image path and the full command line content.
references:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml
author: frack113, Huntrule Team
date: 2021-12-20
modified: 2023-02-13
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith: \sqlcmd.exe
  selection_query:
    CommandLine|contains|all:
      - SELECT
      - TOP
      - "[VeeamBackup].[dbo].[Credentials]"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b57ba453-b384-4ab9-9f40-1038086b4e53
    type: derived