kqlElastic-2.0from elastic/detection-rules

PowerShell Script with Veeam Credential Access Capabilities

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1003 T1555 T1059 T1059.001 T1213

Rule sourcerules/windows/credential_access_posh_veeam_sql.toml

event.category:process and host.os.type:windows and
  powershell.file.script_block_text : (
    (
      "[dbo].[Credentials]" and
      ("Veeam" or "VeeamBackup")
    ) or
    "ProtectedStorage]::GetLocalString"
  )