Skip to content

Commit 5a35230

Browse files
w0rk3rgithub-actions[bot]
w0rk3r
authored and
github-actions[bot]
committed
[New Rules] Veeam Credential Access DRs (#3516)
* [New Rules] Veeam Credential Access DRs * bump * Update credential_access_veeam_commands.toml * Update credential_access_veeam_backup_dll_imageload.toml * Update rules/windows/credential_access_veeam_backup_dll_imageload.toml Co-authored-by: Samirbous <[email protected]> * Update credential_access_veeam_commands.toml * Update rules/windows/credential_access_veeam_backup_dll_imageload.toml Co-authored-by: Terrance DeJesus <[email protected]> --------- Co-authored-by: Ruben Groenewoud <[email protected]> Co-authored-by: Samirbous <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]> (cherry picked from commit 779fa77)
1 parent dbc988d commit 5a35230

3 files changed

+242
-0
lines changed

‎rules/windows/credential_access_posh_veeam_sql.toml

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
[metadata]
2+
creation_date = "2024/03/14"
3+
integration = ["windows"]
4+
maturity = "production"
5+
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6+
min_stack_version = "8.3.0"
7+
updated_date = "2024/03/14"
8+
9+
[rule]
10+
author = ["Elastic"]
11+
description = """
12+
Identifies PowerShell scripts that can access and decrypt Veeam credentials stored in MSSQL databases. Attackers can use
13+
Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks.
14+
"""
15+
from = "now-9m"
16+
index = ["winlogbeat-*", "logs-windows.powershell*"]
17+
language = "kuery"
18+
license = "Elastic License v2"
19+
name = "PowerShell Script with Veeam Credential Access Capabilities"
20+
references = [
21+
"https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html",
22+
"https://www.crowdstrike.com/blog/anatomy-of-alpha-spider-ransomware/"
23+
]
24+
risk_score = 47
25+
rule_id = "5c602cba-ae00-4488-845d-24de2b6d8055"
26+
setup = """## Setup
27+
28+
The 'PowerShell Script Block Logging' logging policy must be enabled.
29+
Steps to implement the logging policy with Advanced Audit Configuration:
30+
31+
```
32+
Computer Configuration >
33+
Administrative Templates >
34+
Windows PowerShell >
35+
Turn on PowerShell Script Block Logging (Enable)
36+
```
37+
38+
Steps to implement the logging policy via registry:
39+
40+
```
41+
reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
42+
```
43+
"""
44+
severity = "medium"
45+
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: PowerShell Logs"]
46+
timestamp_override = "event.ingested"
47+
type = "query"
48+
49+
query = '''
50+
event.category:process and host.os.type:windows and
51+
powershell.file.script_block_text : (
52+
(
53+
"[dbo].[Credentials]" and
54+
("Veeam" or "VeeamBackup")
55+
) or
56+
"ProtectedStorage]::GetLocalString"
57+
)
58+
'''
59+
60+
61+
[[rule.threat]]
62+
framework = "MITRE ATT&CK"
63+
[[rule.threat.technique]]
64+
id = "T1003"
65+
name = "OS Credential Dumping"
66+
reference = "https://attack.mitre.org/techniques/T1003/"
67+
[[rule.threat.technique]]
68+
id = "T1555"
69+
name = "Credentials from Password Stores"
70+
reference = "https://attack.mitre.org/techniques/T1555/"
71+
72+
73+
74+
[rule.threat.tactic]
75+
id = "TA0006"
76+
name = "Credential Access"
77+
reference = "https://attack.mitre.org/tactics/TA0006/"
78+
[[rule.threat]]
79+
framework = "MITRE ATT&CK"
80+
[[rule.threat.technique]]
81+
id = "T1059"
82+
name = "Command and Scripting Interpreter"
83+
reference = "https://attack.mitre.org/techniques/T1059/"
84+
[[rule.threat.technique.subtechnique]]
85+
id = "T1059.001"
86+
name = "PowerShell"
87+
reference = "https://attack.mitre.org/techniques/T1059/001/"
88+
89+
90+
91+
[rule.threat.tactic]
92+
id = "TA0002"
93+
name = "Execution"
94+
reference = "https://attack.mitre.org/tactics/TA0002/"
95+

‎rules/windows/credential_access_veeam_backup_dll_imageload.toml

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
[metadata]
2+
creation_date = "2024/03/14"
3+
integration = ["endpoint"]
4+
maturity = "production"
5+
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6+
min_stack_version = "8.3.0"
7+
updated_date = "2024/03/14"
8+
9+
[rule]
10+
author = ["Elastic"]
11+
description = """
12+
Identifies potential credential decrypt operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll
13+
library. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware
14+
attacks.
15+
"""
16+
from = "now-9m"
17+
index = ["logs-endpoint.events.library*"]
18+
language = "eql"
19+
license = "Elastic License v2"
20+
name = "Veeam Backup Library Loaded by Unusual Process"
21+
risk_score = 47
22+
rule_id = "aaab30ec-b004-4191-95e1-4a14387ef6a6"
23+
severity = "medium"
24+
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Credential Access", "Data Source: Elastic Defend"]
25+
timestamp_override = "event.ingested"
26+
type = "eql"
27+
28+
query = '''
29+
library where host.os.type == "windows" and event.action == "load" and
30+
(dll.name : "Veeam.Backup.Common.dll" or dll.pe.original_file_name : "Veeam.Backup.Common.dll") and
31+
(
32+
process.code_signature.trusted == false or
33+
process.code_signature.exists == false or
34+
process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
35+
)
36+
'''
37+
38+
39+
[[rule.threat]]
40+
framework = "MITRE ATT&CK"
41+
[[rule.threat.technique]]
42+
id = "T1003"
43+
name = "OS Credential Dumping"
44+
reference = "https://attack.mitre.org/techniques/T1003/"
45+
[[rule.threat.technique]]
46+
id = "T1555"
47+
name = "Credentials from Password Stores"
48+
reference = "https://attack.mitre.org/techniques/T1555/"
49+
50+
51+
52+
[rule.threat.tactic]
53+
id = "TA0006"
54+
name = "Credential Access"
55+
reference = "https://attack.mitre.org/tactics/TA0006/"
56+
[[rule.threat]]
57+
framework = "MITRE ATT&CK"
58+
[[rule.threat.technique]]
59+
id = "T1059"
60+
name = "Command and Scripting Interpreter"
61+
reference = "https://attack.mitre.org/techniques/T1059/"
62+
[[rule.threat.technique.subtechnique]]
63+
id = "T1059.001"
64+
name = "PowerShell"
65+
reference = "https://attack.mitre.org/techniques/T1059/001/"
66+
67+
68+
69+
[rule.threat.tactic]
70+
id = "TA0002"
71+
name = "Execution"
72+
reference = "https://attack.mitre.org/tactics/TA0002/"
73+

‎rules/windows/credential_access_veeam_commands.toml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
[metadata]
2+
creation_date = "2024/03/14"
3+
integration = ["windows", "endpoint", "system"]
4+
maturity = "production"
5+
min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6+
min_stack_version = "8.3.0"
7+
updated_date = "2024/03/14"
8+
9+
[rule]
10+
author = ["Elastic"]
11+
description = """
12+
Identifies commands that can access and decrypt Veeam credentials stored in MSSQL databases. Attackers can use Veeam
13+
Credentials to target backups as part of destructive operations such as Ransomware attacks.
14+
"""
15+
from = "now-9m"
16+
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.*", "endgame-*", "logs-system.security*"]
17+
language = "eql"
18+
license = "Elastic License v2"
19+
name = "Potential Veeam Credential Access Command"
20+
references = [
21+
"https://thedfirreport.com/2021/12/13/diavol-ransomware/"
22+
]
23+
risk_score = 47
24+
rule_id = "b661f86d-1c23-4ce7-a59e-2edbdba28247"
25+
severity = "medium"
26+
tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Credential Access", "Data Source: Elastic Endgame", "Data Source: Elastic Defend"]
27+
timestamp_override = "event.ingested"
28+
type = "eql"
29+
30+
query = '''
31+
process where host.os.type == "windows" and event.type == "start" and
32+
(
33+
(process.name : "sqlcmd.exe" or process.pe.original_file_name : "sqlcmd.exe") or
34+
process.args : ("Invoke-Sqlcmd", "Invoke-SqlExecute", "Invoke-DbaQuery", "Invoke-SqlQuery")
35+
) and
36+
process.args : "*[VeeamBackup].[dbo].[Credentials]*"
37+
'''
38+
39+
40+
[[rule.threat]]
41+
framework = "MITRE ATT&CK"
42+
[[rule.threat.technique]]
43+
id = "T1003"
44+
name = "OS Credential Dumping"
45+
reference = "https://attack.mitre.org/techniques/T1003/"
46+
[[rule.threat.technique]]
47+
id = "T1555"
48+
name = "Credentials from Password Stores"
49+
reference = "https://attack.mitre.org/techniques/T1555/"
50+
51+
52+
53+
[rule.threat.tactic]
54+
id = "TA0006"
55+
name = "Credential Access"
56+
reference = "https://attack.mitre.org/tactics/TA0006/"
57+
[[rule.threat]]
58+
framework = "MITRE ATT&CK"
59+
[[rule.threat.technique]]
60+
id = "T1059"
61+
name = "Command and Scripting Interpreter"
62+
reference = "https://attack.mitre.org/techniques/T1059/"
63+
[[rule.threat.technique.subtechnique]]
64+
id = "T1059.001"
65+
name = "PowerShell"
66+
reference = "https://attack.mitre.org/techniques/T1059/001/"
67+
68+
69+
70+
[rule.threat.tactic]
71+
id = "TA0002"
72+
name = "Execution"
73+
reference = "https://attack.mitre.org/tactics/TA0002/"
74+

0 commit comments

Comments
 (0)