Suspicious Child Process Of Veeam Dabatase

Severity: critical
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection_parent`

ParentCommandLine|contains: VEEAMSQL
ParentImage|endswith: '\sqlservr.exe'

Stage 2: `1 of selection_child_1`

or:
CommandLine|contains: '-ex '
CommandLine|contains: DownloadString
CommandLine|contains: bypass
CommandLine|contains: 'copy '
CommandLine|contains: cscript
CommandLine|contains: 'http://'
CommandLine|contains: 'https://'
CommandLine|contains: mshta
CommandLine|contains: regsvr32
CommandLine|contains: rundll32
CommandLine|contains: wscript
or:
Image|endswith: '\cmd.exe'
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
Image|endswith: '\wsl.exe'
Image|endswith: '\wt.exe'

Stage 3: `1 of selection_child_2`

or:
Image|endswith: '\net.exe'
Image|endswith: '\net1.exe'
Image|endswith: '\netstat.exe'
Image|endswith: '\nltest.exe'
Image|endswith: '\ping.exe'
Image|endswith: '\tasklist.exe'
Image|endswith: '\whoami.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-ex` `DownloadString` corpus 5 (sigma 5) `bypass` corpus 2 (sigma 2) `copy` corpus 11 (sigma 11) `cscript` corpus 12 (sigma 12) `http://` corpus 15 (sigma 15) `https://` corpus 14 (sigma 14) `mshta` corpus 11 (sigma 11) `regsvr32` corpus 11 (sigma 11) `rundll32` corpus 19 (sigma 19) `wscript` corpus 12 (sigma 12)
`Image`	ends_with	`\cmd.exe` corpus 92 (sigma 92) `\net.exe` corpus 27 (sigma 27) `\net1.exe` corpus 25 (sigma 25) `\netstat.exe` corpus 5 (sigma 5) `\nltest.exe` corpus 9 (sigma 9) `\ping.exe` corpus 6 (sigma 6) `\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140) `\tasklist.exe` corpus 4 (sigma 4) `\whoami.exe` corpus 18 (sigma 18) `\wsl.exe` corpus 8 (sigma 8) `\wt.exe` corpus 4 (sigma 4)
`ParentCommandLine`	match	`VEEAMSQL`
`ParentImage`	ends_with	`\sqlservr.exe` corpus 3 (sigma 3)