Veeam Backup Database Suspicious SQL Query via SQLCmd

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•38

Detects potentially suspicious SQL queries executed via sqlcmd.exe targeting Veeam backup databases. The rule specifically looks for commands that attempt to query sensitive tables such as BackupRepositories, Backups, Credentials, HostCreds, SmbFileShares, Ssh_creds, and VSphereInfo, which could indicate an attempt to steal information from the Veeam backup infrastructure.