Veeam Backup Credential Extraction via psql.exe Query Against VeeamBackup DB
Detects the use of the PostgreSQL client utility (psql.exe) to directly query the VeeamBackup database for credential information. This behavior is indicative of unauthorized attempts to extract encrypted backup credentials, which may be subsequently decrypted using DPAPI.
Sigma
