Windows: Suspicious child processes spawned from Veeam SQL Server service

Alerts on suspicious cmd/PowerShell/LOLBin and recon utilities spawned by the Veeam SQL service (sqlservr.exe with VEEAMSQL).

FreeUnreviewedSigmacriticalv1

windows-suspicious-child-processes-spawned-from-veeam-sql-server-service-d55b793d

title: "Windows: Suspicious child processes spawned from Veeam SQL Server service"
id: b5b96a64-8978-4e2f-a5a5-0b492eb088b2
related:
  - id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445
    type: similar
  - id: d55b793d-f847-4eea-b59a-5ab09908ac90
    type: derived
status: test
description: This rule flags process creation where the parent process ends with sqlservr.exe and its command line contains VEEAMSQL, followed by a suspicious child process. The child process is matched by specific binaries (cmd.exe, PowerShell variants, WSL, wscript-related tools, etc.) and command-line indicators such as script/bypass patterns, remote retrieval (http/https, DownloadString), and LOLBins execution (mshta/regsvr32/rundll32). It also covers common reconnaissance utilities (net, netstat, nltest, ping, tasklist, whoami) as child processes of the Veeam SQL service. Telemetry required is Windows process creation events including parent image, parent command line, child image, and child command line.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \sqlservr.exe
    ParentCommandLine|contains: VEEAMSQL
  selection_child_1:
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
      - \wsl.exe
      - \wt.exe
    CommandLine|contains:
      - "-ex "
      - bypass
      - cscript
      - DownloadString
      - http://
      - https://
      - mshta
      - regsvr32
      - rundll32
      - wscript
      - "copy "
  selection_child_2:
    Image|endswith:
      - \net.exe
      - \net1.exe
      - \netstat.exe
      - \nltest.exe
      - \ping.exe
      - \tasklist.exe
      - \whoami.exe
  condition: selection_parent and 1 of selection_child_*
level: critical
license: DRL-1.1

What it detects

This rule flags process creation where the parent process ends with sqlservr.exe and its command line contains VEEAMSQL, followed by a suspicious child process. The child process is matched by specific binaries (cmd.exe, PowerShell variants, WSL, wscript-related tools, etc.) and command-line indicators such as script/bypass patterns, remote retrieval (http/https, DownloadString), and LOLBins execution (mshta/regsvr32/rundll32). It also covers common reconnaissance utilities (net, netstat, nltest, ping, tasklist, whoami) as child processes of the Veeam SQL service. Telemetry required is Windows process creation events including parent image, parent command line, child image, and child command line.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.