Suspicious Child Process from Veeam SQL Database

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•45

Detects suspicious child processes spawned by the Veeam SQL Server database process. This activity could indicate a successful Remote Code Execution (RCE) or SQL Injection attack against the Veeam database, where an attacker has managed to execute system commands or scripts.