Anvilogic high experimental other
Attempted Veeam Database Credential Dump [snowflake-crowdstrikefdr_process]
Operators from the Diavol ransomware gang were observed using sqlcmd to extract encrypted credentials from Veeam databases that were decrypted using a publicly documented technique on Veeam's R+D forums. This use case detects commands targeting credentials stored in Veeam databases. While sqlcmd.exe was used in documented cases, the logic is not reliant on detecting sqlcmd.exe to account for instances where the binary has been renamed or another utility was used to interact with the database. -- Threat Actor Association: UTA0178 -- Software Association: Akira
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and process ilike '%
SELECT%' and process ilike '%[user_name]%' and process ilike '%[password]%' and process ilike '%
FROM%' and process ilike '%[VeeamBackup].[dbo].[Credentials]%'Field Validations
Loading…
Comments (0)
Loading comments...