Veeam Backup Servers Credential Dumping Script Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•39

Detects the execution of a PowerShell script designed to dump stored credentials from Veeam Backup servers. The script specifically targets the "Veeam.Backup" class and uses `Invoke-Sqlcmd` to extract sensitive information, likely from the Veeam configuration database.