VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Detects an attempt to dump credentials from the VeeamBackup database using sqlcmd.exe by querying the 'VeeamBackup.dbo.Credentials' table. This activity is indicative of an attacker trying to extract sensitive information, potentially for lateral movement or further compromise.
Sigma
