Akira - Veeam credential extraction via psql.exe querying VeeamBackup DB

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects the execution of psql.exe with arguments pointing to a VeeamBackup database, or suspicious database queries containing 'credentials' or 'SELECT' statements. The rule specifically alerts when this behavior is initiated by PowerShell or WMI processes, which are common indicators of automated post-exploitation activities intended to extract sensitive information from the backup infrastructure.