Skip to main content
  • EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 168 Topics
  • 915 Comments
168 Topics
Rick Vanover
Rick VanoverRICKATRON
posted in YARA and Script Library
How to install a YARA rule with Veeam

We’ve updated the Script Library section to include YARA rules. I’ve made a quick video (sorry for the cheesy graphics...) on how to install a YARA rule from this site and perform your first scan! 

153412
Rick Vanover
11 months ago
Rick Vanover
Rick VanoverRICKATRON
published in YARA and Script Library
YARA and Script Library Supportability

Welcome to the YARA and Script Library! This area of the community hub will provide community driven scripts and YARA rules, with selected featured items.  Veeam Data Platform 23H2 includes Veeam Backup & Replication v12.1 which includes YARA Scanning. This area of the Veeam Community Hub will offer featured YARA rules for use. Custom script troubleshooting is not supported. What's in Scope:Confirming that Veeam Backup & Replication recognized the YARA rule file.What's Out of Scope:Troubleshooting why a custom YARA rule did not function as intended.This area also includes scripts in the Script Library. Generally speaking, scripts are licensed to you by the sample's author and fall under your responsibility and is governed by the Veeam Customer Support Policy. The figure below summarizes the scripting support for PowerShell:Excerpt from KB2183: PowerShell Script Execution Troubleshooting Advice (veeam.com) 

10620
Rick Vanover
1 year ago
Martin Weber
Martin WeberComes here often
posted in YARA and Script Library
Pre-Check for update VEEAM to Version 12 using VMware

Hello together,before you update VEEAM to Version 12 using VMware vCenter/ESXi please check VMs HardDisks for duplicate UUID. In Version 11 this was never a problem. In the new Version VEEAM checks the UUID and backup will fail.VMware has no problem with that most time. But they know the Problem - https://kb.vmware.com/s/article/2006865This command will find any HardDisk with duplicate UUID - please note that this is VMware PowerCLI commandGet-VM | Get-HardDisk | Select @{N='VM';E={$_.Parent.Name}}, @{N='Uuid';E={$_.ExtensionData.Backing.Uuid}} | Group-Object -Property Uuid | ?{ $_.Count -gt 1 }As Service Provider such changes in VEEAM are a total disaster!!

125837
AndrePulia
24 days ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Veeam Backup & Replication 12.3 - New REST API features & new Python scripts

Veeam Backup & Replication 12.3 – A big release with many new functions. Let me show you some of the exciting new possibilities with REST API. And yes, I have also created some scripts 😉Scanning Backups & Veeam Threat HunterVeeam Backup & Replication offers various methods of scanning backups for malware. The Secure Restore feature allows for malware scanning during recovery, preventing the reintroduction of infected files. The Scan Backup functionality will enable you to check backups for malware on-demand. SureBackup provides the possibility to execute this task on a regular or even continuous basis.With the introduction of the Veeam Threat Hunter in Veeam Backup & Replication 12.3, the scanning capabilities become even more powerful. Read the Veeam Backup & Replication v12.3 - What’s new document (page 7) describing the Veeam Threat Hunter capabilities.❗Don’t forget to select the Veeam Threat Hunter in the Malware Detection Settings.Scan Backups using REST APIWi

1445
Geoff Burke
26 days ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
VBR Generate Syslog Event Filter XML File

Starting with Veeam Backup & Replication 12.3, it is possible to exclude specific events from being sent to the Syslog server. This can be done manually per event, or you can import an XML file with the events to be filtered.Handling this task and finding the necessary information can be time-consuming. Executing this task manually is “boring” and error-prone, so I created a simple PowerShell script to make the process easier by generating an XML file based on your chosen filters. Whether filtering by event IDs, categories, or specific filter types like Info, Warning, or Error, this script makes this task more fun.🕺🏿💃🏽For more details and examples of usage, check out the README in my GitHub repository.Happy filtering - It’s the most wonderful time of the year to write scripts 😉🎶Steve💚  

322
Chris.Childerhose
28 days ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - OneDrive for Business File Scanner

Hello Community!It's been two years since I published a script for a OneDrive for Business file check in this community. And even back then I had the code ready that also checks recovered files for possible malware. Of course, Microsoft 365 also has certain mechanisms, which are documented here.Trust is good, control is betterI have now taken up my idea again and packed it into a new script. The script restores files from the lastest OneDrive for Business restore point and scans them for threats using Windows Defender. A single file can also be restored and scanned.There is a "beautiful" listing when the scan has detected something.Please read the README document on my GitHub for more details on how to use the script.⛔Important!⛔ Make sure that there is sufficient disk space in the directory where the files are to be restored. Also use an empty directory to save the data, as the script cleans everything up after execution.Question to the communityWhat do you think of a script that rest

853
vAdmin
1 month ago
J
Jeroen Buren EFCINew Here
asked in YARA and Script Library
Create NAS backup job with PowerShell

Hi everyone, I'm using Veeam for quite a while now but recently we added some NetApp ONTAP devices to the storage infrastructure. And for each also a NAS Filer object under unstructured data. I can select a NAS Filer and create a file backup job easily. But I want to automate this if possible.I can use Get-NetAppHost to get the ONTAP device and then use Get-VBRUnstructuredServer combined with Get-VBRNASServerPath but I can't link it all together… Also, when I look at an already configured job I cannot reverse engineer this to usable PS code.Can someone point me in the right direction to create a file backup job of a share on a NAS filer with PowerShell?

332
Chris.Childerhose
1 month ago
T
ThePlaneskeeperNot a newbie anymore
posted in YARA and Script Library
Immutable Storage actual disk used per folder

Inherency:Since we bill by actual disk usage for our client utilizing CloudConnect, the existing reports are non-functional for reporting and billing (They report pre-deduplication/reflink data).  It took a while to figure out, but there is a way to calculate actual disk space used on a per directory on an immutable repository.Solution:Using: https://community.veeam.com/blogs-and-podcasts-57/check-reflink-and-spared-space-on-xfs-repositories-244 I have extrapolated a script that will give the disk usage of each folder (IE: client) on an immutable repo.  This isn't "Data used"; that is what Veeam reports.  This is "Disk Used".  The actual size on disk after reflinks (duplicated data is only counted once). A note about this script; it appears that the original blog entry is wrong on the size of a block.  They attribute it to 4096... which is true... on disk... but the utility used explicitly gives the information in block sizes of 512:https://linux.die.net/man/8/xfs_bmap"units of 512-byt

145615
A
1 month ago
Link State
Link StateVeeam Legend
posted in YARA and Script Library
How to automate Veeam.Backup.Validator.exe powershel script V12

Hello everyone, as per my previous post.How to atomate & schedule Veeam.Backup.Validator.exe | Veeam Community Resource Hub I am proceeding as promised to update the schedulable veeam validator script. enjoiy 😁### Veeam Backup Validator - v.2.0 18-10-2024## USAGE:## > veeam-BackupValidator2.ps1 <jobName> <serverName> <Switch>## Switch:# -noTicket -> does not send mail to your system ticketing\servicedesk after Validate is completed## e.g.# > veeam-BackupValidator2.ps1 ‘Yout-Job-name-01’ ‘Yout-Job-name-02’ -notTicket no mail###PARAM (# [string] $customer = "YOUR CUSTOMER NAME", [string] $jobName = '*', [string] $serverName = '*', [switch] $noTicket )## -- Enter the customer name identifier here ($customer = "YOUR CUSTOMER NAME") --$customer = "YOUR CUSTOMER NAME"##$email_infoTO = "youtmail@yourdomain.com"$email_infoFrom = "$($env:COMPUTERNAME)@iyourdomain.com"$email_infoServer = "your.smtp.com"$email_subject = "[$customer] Backup Validation"$logfolder = "

983
waqasali
1 month ago
F
fjlComes here often
asked in YARA and Script Library
Prompt for upgrade and update. After scanning, it prompts that the file does not exist. What should be done?

提示升级和更新。扫描后，它会提示该文件不存在。应该怎么做？我觉得这个需要手动更新，我不知道该怎么办 

175
Chris.Childerhose
2 months ago
jcolonfzenpr
jcolonfzenprVeeam Vanguard
posted in YARA and Script Library
Diagramming the Veeam Backup & Replication Infrastructure

Hello, As you may know I have been working for some time with several tools to document or diagram the Veeam Backup & Replica Infrastructure. In the latest version of Veeam.Diagrammer the ability to generate a diagram of the infrastructure has been added. Here is the link:https://techmyth.blog/posts/veeam-diagraming-infra/ Greetings from the Caribbean :) 

87461
MarcoLuvisi
2 months ago
Timothy Dewin
Timothy DewinComes here often
posted in YARA and Script Library
Veeam Hardened Repo: Firewalld security zones

Disclaimer: This is only provided as a reference. Make sure you understand what you are doing before executing this in your own setup (eg test in a lab). Since this is modifying the firewall, you might lock yourself out remotely if you are executing the steps incorrectly or you have a slightly different setupIf you are running RHEL or any experimental derivative (in my case Rocky 8.8), you can use firewalld to configure the firewall. Firewalld uses zones in which you can allow ports or services based on the incoming interface or IP sources. By default, all the traffic is “allowed” based on the rules in the public zone (or better the interfaces are by default assigned to the public zone). You can test this with# What is the default zonefirewall-cmd --get-default-zone# What are the active zones, by default only the public zonefirewall-cmd --get-active-zones# List all the rules in the public zone, this is by default ssh cockpit and dhcpv6firewall-cmd --zone=public --list-allYou can howeve

12033
K
3 months ago
tarik.yenisey
tarik.yeniseyInfluencer
asked in YARA and Script Library
Veeam Yara Rules - Malware Scan

Hello everyone, First of all, I would like to ask my community because I am not fully familiar with Yara rules. When scanning for Malware Detection with Yara rules, can you see which files have Malware in which locations with Yara Rules? When I do a direct Malware scan, if there is malware, it shows the machine under the malware tab but does not give details. What can I do for more details here Hello everyone,

2011
Chris.Childerhose
4 months ago
coolsport00
coolsport00Veeam Legend
posted in YARA and Script Library
Change Rate Script?

This is me being a bit lazy, so apologize in advance. Does anyone have a script, or know of a VBR type report which retrieves change rate for VMs in a Backup Job? Obviously I know about VONE, but we don’t use that (maybe I can do a temp 30-day trial install...but would like something a bit quicker and temporary). I’ve run into a situation since last wk where 1 or a few VMs in a job have changed the backup rate significantly since last wk, by almost 10-fold, causing me to run out of space not only on this Job Repo, but my storage array! I’m trying to work through it, but would like to know the culprit(s) to let the app owners know to chill! haha There was a couple app VMs with updates, etc since last wk, so I have an idea a little bit of what’s going on. But, I’d like to pinpoint things a bit better.Thank you Community!

1027
marco_s
4 months ago
kristofpoppe
kristofpoppeVeeam Vanguard
posted in YARA and Script Library
Add new API permissions to existing App registration for VB 365

With the release of the version 8 of VB 365, some additional permissions are needed on the registred app. Nothing to think about when you’re deploying a new app, but when you’re upgrading, you coudl re-use the existing app and extend it with the new requirements. I’m not a programmer, but I’ve tried to setup a small powershell script that based on your Application ID adds the necessary rights and also adds the app to the Global Reader role.Feel free to check and modify it ! Could be a time-saver ! # Ensure that the required modules are installedInstall-Module -Name AzureAD -Force -AllowClobberInstall-Module -Name Microsoft.Graph -Force -AllowClobber# Import modulesImport-Module AzureADImport-Module Microsoft.Graph# Connect to the Microsoft TenantWrite-Host "Connecting to Microsoft Tenant..." -ForegroundColor CyanConnect-AzureAD# Get Application (App Registration) ID$appId = Read-Host "Please enter the Application (Client) ID for the App Registration"# Get the Application's Object ID$ap

834
Chris.Childerhose
4 months ago
vAdmin
vAdminInfluencer
posted in YARA and Script Library
Get the most recent malware detection logs from each Veeam Server and send over email with summary

Hi Everyone, I'm sharing the script to collect the latest Malware Detection logs from specific lists of Veeam Backup servers in their default directory as the attachment with the server name at the end.When there is no new malware detection log file generated on the day, then no email will be sent out.You can update the $Servers and the $ParamSendmailMessage accordingly to suit your needs, as well as the CSS styling.$Servers = 'VBR01', 'BACKUP01', 'BKP-SVR', 'VBRSVR02'$LocalIPAddress = (Resolve-DnsName -Name $ENV:COMPUTERNAME | Where-Object { $_.Type -eq 'A' } | Select-Object -ExpandProperty IPAddress) -join ', '$Filter = '*.LOG'$paramSendMailMessage = @{ From = "$ENV:COMPUTERNAME@$env:userdnsdomain" To = 'your.email@veeam.com' Subject = "Malware report summary as of $(Get-Date -Format 'F')" SmtpServer = 'smtp.domain.com' BodyAsHtml = $true Priority = 'High'}$HtmlHead = @"<style> body { font-family: Calibri; }

6198
Scott
4 months ago
X
Xtouf-GANot a newbie anymore
asked in YARA and Script Library
Veeam Backup AWS Script: Modify Policy

Hello,I have more than 700 policies on my VBAws serveurs. I have ton change fiew setting.I know how to create AWS Acoount / Policies I use PowerShell and Invoke-RestMethod  I’m not able to modify polices: I do not find a way even in the swagger If someone can share the way to modify account or Policies nvoke-RestMethod -Uri $TheUrl -Method Put -Body $json -ContentType "application/json" -Headers $Headers -NoProxy -SkipCertificateCheckRegards

322
D
5 months ago
H
HashtonicNew Here
asked in YARA and Script Library
Get all backup session IDs for particular location

Could anyone help for the following scenario . [Veeam.Backup.Core.CBackupSession]::GetAll() For the above command do we have any commands as the above one not fetching all backup session ids done for particular location.

1446
D
5 months ago
H
HashtonicNew Here
asked in YARA and Script Library
VBR module failed to fetch all client(Servers) from backup

VBR module unable to fetch complete list of servers(clients) from a backup job. As some physical server backup job ids are not getting populated even it’s taken the backup. 

545
H
5 months ago
Z
Zahra.HaratiNew Here
asked in YARA and Script Library
Using Terraform Import New Accounts in AWS to the Veeam AWS Appliance

We have a Veeam AWS Appliance in its own backup account on the latest version, 7.1.08We are backing up more than 200 AWS accounts. I am looking for a Terraform code that, when included in creating a new AWS Account, automatically imports the account to the Veeam appliance. I looked into the Veeam Hub and did not find any. The only Terraform code I found was for deploying the Veeam AWS Appliance.Does anyone have the Terraform code, or is this possible with Veeam AWS Appliance?Thanks,Zahra   

403
SteveHeart
6 months ago
jcolonfzenpr
jcolonfzenprVeeam Vanguard
posted in YARA and Script Library
AsBuiltReport for Veeam Backup for Microsoft 365

Hello,These last few weeks I have had the time to give some attention to the AsBuiltReport.Veeam.VB365 report. This time a lot of improvements and new sessions were added to collect much more information about the Veeam Backup for Microsoft 365 infrastructure. Here I provide you with the changes:https://github.com/AsBuiltReport/AsBuiltReport.Veeam.VB365/releases/tag/v0.3.0 Now the reason for writing this post is to share with all of you about a project I have been working on in my spare time and it is about Diagramming the Veeam infrastructure. In this new version of the AsBuiltReport.Veeam.VB365 report I added the ability to create a simple diagram of the deployed VB365 components. This tool uses Graphviz and the PSGraph module to generate the diagram. Here is the main link where you can see how to use the report:https://github.com/AsBuiltReport/AsBuiltReport.Veeam.VB365In this link you can find the code I use to generate the diagram!https://github.com/AsBuiltReport/AsBuiltReport.Veea

1535
admd
6 months ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - VBR Backup Scan - YARA ready

Hi Community,after Rick's announcement (thanks for the initiative), I couldn't resist creating another script for the community.As documented, you can add one YARA rule file to the scan process. But what if you want to use multiple YARA rules? Of course you could work with a so-called index file, which refers to the individual YARA rules, but this brings a problem with it, because the YARA rules are stored on the VBR server, but the scan process provides the backups on the mount server and only one YARA rule can be used (This is a topic for another blog post - stay tuned).  What if we would like to use all YARA rules from Rick's Top 10 Ransomware Threats  blog post for a scan? And we don’t want to click so many times in the UI? This Powershell script can help. You can select all YARA rules, only selected YARA rules or all YARA rules if no selection has been made after 30 seconds. The script needs the backup job name and the hostname which has to be scanned. .\vbr-scan-backups.ps1 -Jobn

63726
L
6 months ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
New & Improved: Veeam Usage Report for VMware Cloud Director

This collection of PowerShell scripts can be used to retrieve Veeam backup usage for VMware Cloud Director (VCD) backup jobs and is now available on VeeamHub! Below is a brief description of its functionality. For more detailed information, please follow the VeeamHub link.In this collection, you’ll find 3 scripts:Sync-VcdOrganizationMapping.ps1: Automated mapping of a VCD Organization Veeam Service Provider Console (VSPC) Company Set-HostedVbrJobAssignment.ps1: Assigns VCD backup jobs to a VSPC Company Get-VspcHostedUsage.ps1: Generates usage reportIn the usage report, the following is provided for each VSPC Company:Total number of protected VMs in backups Total number of licensed VMs in backups Licensed matches Veeam rental licensing policy which is workloads protected within the current calendar month Total amount of space used in backups (Optional) Detailed usage at the VM-levelNOTE: This collection uses functionality added in Veeam Backup & Replication v12.1 and Veeam Service

1362
A
6 months ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Veeam Usage Report for VMware Cloud Director

Deprecated: This script will not work with Veeam Backup & Replication v12. For v12 support, please use the VSPC-HostedUsage scripts. The PowerShell script to retrieve Veeam backup usage for VMware Cloud Director (VCD) Organizations is now available on VeeamHub! Below is a brief description of its functionality. For more detailed information, please follow the VeeamHub link.For each organization, the following is provided:Total number of VMs in backups Total amount of space used in repositoriesThe usage data can be aggregated on the Organization-level or the Org VDC-level. This is useful when backups for different Org VDCs are billed differently.The scope of the usage returned is also customizable. It can be limited to self-service backups, created by the Veeam Self-Service Portal (VSSP) for VCD, or it can also include backups created directly on the backup server by the provider.NOTE: Before using this script in a production environment, I recommend you verify that numbers match up

2452
A
6 months ago
D
dionmitchell
asked in YARA and Script Library
Set-VBRViReplicaJob : Broker service has not started hierarchy collection for host

Hi All, I recently migrated some replicated VM’s on our VMWare infrastructure to a new DVSwitch and updated VLAN names, so I had to update all the Veeam replication jobs, when i tried to automate this using the Veeam powershell library I got the following error on 95% of the jobs. I did a little investigation but didnt manage to figure out what the difference was between all the failed jobs and the 3 that successfully updated. Has anyone ever seen this error message before ? Set-VBRViReplicaJob : Broker service has not started hierarchy collection for host xxxxx Here is a simplified version of the script i was using:# get all replication jobs$jobs = Get-VBRJob | Where-Object TypeToString -eq "VMware Replication"foreach ($job in $jobs) { $jobOptions = Get-VBRJobOptions -Job $job # get list of network objects on new target dvswitch $destSwitchNets = Get-VBRViServerNetworkInfo -Server "<server with new dv switch>" | Where-Object SwitchName -eq "NEW SWITCH" # build array

4775
Chris.Childerhose
6 months ago

Badge winners

  • Veeam University Pro
    gmani2486has earned the badge Veeam University Pro
  • Veeam University Pro
    stavroshas earned the badge Veeam University Pro
  • Veeam Employee
    JShaphas earned the badge Veeam Employee
  • Veeam Employee
    Kurt_Hultberghas earned the badge Veeam Employee
  • Veeam Employee
    MCarrarahas earned the badge Veeam Employee
Show all badges
Terms & Conditions