Akira - Veeam Backup Credential Theft via psql.exe or PowerShell
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Sigma
