Malware Detection Behavior: Inline Entropy vs. SureBackup Job Results

Entropy analysis is for Encryption events.  You want to take a look at the File Detection & Signature Detection tabs to enable those for this purpose.

Hi ​@yunus.tasci -

Inline Entropy detects 3 different types of block files → Encryption, Onion Links, and Ransomware Notes. The .onion file “should’ve” been detected. According to the User Guide:

https://helpcenter.veeam.com/docs/vbr/userguide/malware_detection_data_blocks.html?ver=13

But, there are specific formats & criteria those files must take to where VBR Backup Jobs should then be able to detect them. Read through the info at the link I shared to help explain how Veeam is supposed to detect such items. 

But, if what is shared there isn’t too clear, you’ll have to speak with Veeam Support to get clarification on the descrepancy between what the User Guide says and what your testing is showing.

Hope that helps.

Hi, ​@yunus.tasci 

This behavior can be expected depending on how the test was performed. Inline Entropy Analysis is not a full file-content scan of the current restore point. During backup, Veeam creates an RIDX ransomware index and, after the job completes, the Veeam Data Analyzer Service compares the new RIDX with an earlier restore point. If no previous RIDX exists, the first RIDX is created only as a baseline and is not analyzed. Therefore, if the onion link and ransom note were already present before the first inline-enabled backup, they became part of the baseline and no event would be generated. The same applies to subsequent restore points if the number of detected artifacts does not increase.

https://helpcenter.veeam.com/docs/vbr/userguide/malware_detection_inline_scan_hiw.html?ver=13

Inline detection of text artifacts is also intentionally narrow. The onion address must be a valid v3 address containing exactly 56 [a-z2-7] characters, and the documented ransomware-note detection currently covers Medusa and Clop notes. The text must be UTF-8, the file-system block size must be 4 KB, and the file data must not be resident in the NTFS MFT. A very small test .txt file can therefore be missed by the inline block scanner.

SureBackup is a different detection layer. Its malware/content scan uses the selected Threat Hunter, antivirus or YARA engine against the restore point’s file content, so it can detect static artifacts already present in the backup without requiring a previous clean RIDX baseline or an increase in artifact count.

To validate the Inline Detection feature during backup, I suggest running two consecutive backups: first, perform a clean backup without any test artifacts to establish the baseline; then add an .onion address or a ransomware-note sample and run a second backup. After the second backup completes, check the Malware Events view for detection results.