Windows: Suspicious child processes spawned from Veeam SQL Server service
Alerts on suspicious cmd/PowerShell/LOLBin and recon utilities spawned by the Veeam SQL service (sqlservr.exe with VEEAMSQL).
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-04
- Updated
- 2026-07-30
What it detects
This rule flags process creation where the parent process ends with sqlservr.exe and its command line contains VEEAMSQL, followed by a suspicious child process. The child process is matched by specific binaries (cmd.exe, PowerShell variants, WSL, wscript-related tools, etc.) and command-line indicators such as script/bypass patterns, remote retrieval (http/https, DownloadString), and LOLBins execution (mshta/regsvr32/rundll32). It also covers common reconnaissance utilities (net, netstat, nltest, ping, tasklist, whoami) as child processes of the Veeam SQL service. Telemetry required is Windows process creation events including parent image, parent command line, child image, and child command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious child processes spawned from Veeam SQL Server service"
id: b5b96a64-8978-4e2f-a5a5-0b492eb088b2
related:
- id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445
type: similar
- id: d55b793d-f847-4eea-b59a-5ab09908ac90
type: derived
status: test
description: This rule flags process creation where the parent process ends with sqlservr.exe and its command line contains VEEAMSQL, followed by a suspicious child process. The child process is matched by specific binaries (cmd.exe, PowerShell variants, WSL, wscript-related tools, etc.) and command-line indicators such as script/bypass patterns, remote retrieval (http/https, DownloadString), and LOLBins execution (mshta/regsvr32/rundll32). It also covers common reconnaissance utilities (net, netstat, nltest, ping, tasklist, whoami) as child processes of the Veeam SQL service. Telemetry required is Windows process creation events including parent image, parent command line, child image, and child command line.
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
- attack.initial-access
- attack.persistence
- attack.privilege-escalation
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: \sqlservr.exe
ParentCommandLine|contains: VEEAMSQL
selection_child_1:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wsl.exe
- \wt.exe
CommandLine|contains:
- "-ex "
- bypass
- cscript
- DownloadString
- http://
- https://
- mshta
- regsvr32
- rundll32
- wscript
- "copy "
selection_child_2:
Image|endswith:
- \net.exe
- \net1.exe
- \netstat.exe
- \nltest.exe
- \ping.exe
- \tasklist.exe
- \whoami.exe
condition: selection_parent and 1 of selection_child_*
level: critical
license: DRL-1.1