Veeam ONE — unauthenticated request pattern preceding code execution (CVE-2026-64633)
Detects instances where Veeam ONE Agent components (VeeamOneAgent, VeeamOneWebService, or VeeamOneReportingSvc) initiate common command and scripting interpreters like cmd.exe, powershell.exe, cscript.exe, or wscript.exe. This activity is often indicative of potential exploitation of the backup management software or administrative abuse.
Microsoft Sentinel (KQL)
