12.1 Malware Detection

We have just has a Veeam Malware Detection on a Cisco FMC VMWare VM backup. It’s a Ransomware Note detection. I am thinking the Cisco FMC could legitimately have this in a signature file for AMP, and so it’s a false positive - does anyone agree, please?

 

@Charles Leighton - it's difficult to say definitively because 1. Don't know your environment, & 2. Ransomware Note is an Inline Scan & Veeam doesn't provide file names or locations.

That being said, Veeam is working on feature updates for their Malware engine which should help. No timeframe when the update will come though. 

That would be perfect. It’s such a new feature I think this will only grow as versions increase. The fact it did trigger some real alerts of encrypted files from something that happened years ago allowed me to clean it all up, and makes me not want to exclude everything.  

Well in my case if it’s omit specific folders, or don’t use the feature at all, I know what option I’ll chose. 

That being said, I understand that if someone omits a root folder it’s not going to be monitored, but if you are going to that extreme you might as well just disable malware scans on that server. 

I like the idea of choosing to ignore file types on specific folders/servers. Perhaps I save files to a single location that trigger it every week. That would solve the issue, but not effect monitoring somewhere I want to be alerted on that file type.

I think the idea of accepting currently flagged false positives is the easiest sell though. Users could even have to accept the risk. The list of locations from the malware log file could show up on screen and force them to click confirm to put the responsibility on the Veeam Admin. 

It’s would have to be a combination of both to be preventative and reactive to many years of files that I don’t want to go ignore every single folder.  

Ooh can we get a hint.  🤣

Just you wait on feature requests :) I have something brewing. 

From my point of view, folder exclusions can be dangerous as you no longer have control and they would never be checked again by the inline scan.

You would need a rule of overwriting scan alarms already detected and accepted by the operator previously and only alerting you if new files are detected etc. 
 

I would be all for this definitely.  It would in a similar fashion to AV exclusions where you can do file, folder, etc.

Rick - what do you think of the ability to be able to add folders exclusions, as a future feature enhancement? It appears it would have value. Thoughts?

Not sure if you use VONE but there are some nice reports and alerts there too for the Malware piece.

Clicking exclude workload will just omit all my file servers which is really what I want to do.

Interesting enough the files are all back though showing the false positives from last nights backups.

I’ll look into this a bit more and see what I can do with the rules. It’s not the end of the world. I did find a bunch of encrypted files from years back when there was an incident so the feature works. 

I suppose I can just look at the logs everyday to see if there is a change in file size, or create a script to extract the current days vs the previous days and show the differences. I could email that to myself to not have to do it manually. 

I think this marks that run clean and restore points on disk but does not mean it will not detect it again. At least that is what I have seen in testing.

check this @Scott  

How Malware Detection Works - User Guide for VMware vSphere (veeam.com)

Managing Malware Status - User Guide for VMware vSphere (veeam.com)

You can open a ticket to support for clarification