Skip to content
Threat Feed

Product

Veeam Backup

3 briefs RSS
medium advisory

Potential Veeam Credential Access via SQL Commands

Attackers can leverage sqlcmd.exe or PowerShell commands like Invoke-Sqlcmd to access Veeam credentials stored in MSSQL databases, potentially targeting backups for destructive operations such as ransomware attacks.

Microsoft Defender XDR +1 veeam credential-access mssql windows ransomware
2r 5t
medium advisory

Veeam Backup Library Loaded by Unusual Process

Detects potential credential decryption operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library, indicating potential credential access attempts to target backups as part of destructive operations.

Veeam Backup credential-access veeam powershell
2r 3t
medium advisory

Detecting Remote Windows Service Installation for Lateral Movement

This rule detects a network logon followed by Windows service creation with the same LogonId on a Windows host, which could indicate lateral movement or persistence by adversaries.

Windows +4 lateral-movement persistence
2r 3t