Veeam Backup PostgreSQL Credential Extraction via PowerShell (Akira Campaign)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).