Skip to main content
  • EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 178 Topics
  • 986 Comments
178 Topics
Rick Vanover
Rick VanoverRICKATRON
posted in YARA and Script Library
How to install a YARA rule with Veeam

We’ve updated the Script Library section to include YARA rules. I’ve made a quick video (sorry for the cheesy graphics...) on how to install a YARA rule from this site and perform your first scan! 

199112
Rick Vanover
Rick Vanover
Rick VanoverRICKATRON
published in YARA and Script Library
YARA and Script Library Supportability

Welcome to the YARA and Script Library! This area of the community hub will provide community driven scripts and YARA rules, with selected featured items.  Veeam Data Platform 23H2 includes Veeam Backup & Replication v12.1 which includes YARA Scanning. This area of the Veeam Community Hub will offer featured YARA rules for use. Custom script troubleshooting is not supported. What's in Scope:Confirming that Veeam Backup & Replication recognized the YARA rule file.What's Out of Scope:Troubleshooting why a custom YARA rule did not function as intended.This area also includes scripts in the Script Library. Generally speaking, scripts are licensed to you by the sample's author and fall under your responsibility and is governed by the Veeam Customer Support Policy. The figure below summarizes the scripting support for PowerShell:Excerpt from KB2183: PowerShell Script Execution Troubleshooting Advice (veeam.com) 

13510
Rick Vanover
T
TK515Comes here often
asked in YARA and Script Library
Running Scripts from Job

Im trying to run a powershell script to turn off/on a service on the remote computer. I run Veeam VBR as a local service instead of an AD service account. Is this why my script is failing?Ive tried both of these and using SNMP as an example. Of course they both work interactively from the VBRserverGet-Service -computername RemoteComputer -DisplayName "SNMP Service"| Stop-Serviceinvoke-command -ComputerName RemoteComputer -ScriptBlock {Get-Service -Name "SNMP"| Stop-Service}  **********************Windows PowerShell transcript startStart time: 20250807125230Username: WCG\SYSTEMRunAs User: WCG\SYSTEMConfiguration Name: Machine: VBRserver (Microsoft Windows NT 10.0.17763.0)Host Application: powershell.exe -ExecutionPolicy ByPass -Command  try {& 'C:\VeeamScripts\freeze-tk.ps1'  -ErrorAction Stop } catch { exit 1 } Process ID: 24996PSVersion: 5.1.17763.7553PSEdition: DesktopPSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17763.7553BuildVersion: 10.0.17763.7553CLRVersion: 4.0.30319.4

464
damien commenge
Rick Vanover
Rick VanoverRICKATRON
published in YARA and Script Library
Featured YARA rule: Top 10 Ransomware Threats

Now that V12.1 is available, I wanted to share with you a featured YARA rule set that can give you on-demand scanning for some top ransomware threats. Attached to this post is a file named: Top10RW_YARArules.zip. In this file are YARA rules for some common ransomware threats that have been seen recently:Attribution: This great collection was made by Felix Bilsten. Links: X: Felix Bilstein (@fxb_b) / X (twitter.com), website: Felix Bilstein - project overview (cocacoding.com) and Github: fxb-cocacoding (Felix Bilstein) · GitHub

252016
waqasali
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Find Threats in Your Backups – With Retro Hunter 🕵🏾‍♀️

The project announced here became even bigger. However, the Veeam Data Integration API remains the "main actor", except that many new options have now been added, as "my ideas factory" and feedback on a similar script have been incorporated. Let’s look at what’s NEW.📑 SearchThe host2scan parameter scans a selected restore point of the specified host. The repo2scan parameter can display all hosts with supported restore points in the specified Backup Repository. Then select a host and start the scan. NEW Or with repo2scan and the option all to scan the latest restore point for all found and supported host types in the specified Backup Repository. NEW🔍 Scan & StoreThe scan parameter triggers the malware and LOLBAS detection scan. The store parameter collects the metadata for all relevant binary files (ideal for hash analysis). NEW The yaramode parameter triggers a YARA scan using the stored rule(s). NEW📊 Display NEWThe data is displayed in a wonderful Streamlit Dashboard. In the pi

2915
SteveHeart
Rick Vanover
Rick VanoverRICKATRON
posted in YARA and Script Library
Quick Tip: Veeam Intelligence Can Write YARA Rules!

One of the great things about AI is that it can be improved in the background, and Veeam Intelligence is no different. I have used AI (namely a GPT) to create a YARA rule, which I’ve found to be easier and servicing quicker than finding some shared online. It is no surprise that Veeam Intelligence is here to help in the same regard. I had a discussion with ​@kirststoner12 about this and sure enough - Veeam Intelligence was able to do this generative AI task within Veeam. I did a simple prompt:Can you generate a YARA rule to look in backups for credit card numbers stored in plain text?  The result was rather quick and created in Veeam intelligence with ease: This is just one quick example of how you can use Veeam Intelligence to have some AI-powered resources right inside of your Veeam Backup & Replication console. 

1125
Rick Vanover
Adrian Meneses
Adrian MenesesNot a newbie anymore
posted in YARA and Script Library
U se Veeam Intelligence, I ask to create a rule to detect common Ransomware families

I hope you're all doing well.I'm reaching out to the community for some guidance. As a test, I recently used Veeam intelligence to scan our infrastructure.Based on the scan, Veeam intelligence created  the following rule:[rule CommonRansomware{    meta:        description = "Detects common ransomware families"        author = "Veeam Support Assistant"        date = "2023-10-01"    strings:        $locky = "Locky"        $wannacry = "WannaCry"        $petya = "Petya"        $notpetya = "NotPetya"        $cerber = "Cerber"        $cryptolocker = "CryptoLocker"        $cryptowall = "CryptoWall"        $badrabbit = "BadRabbit"        $ryuk = "Ryuk"        $maze = "Maze"        $revil = "REvil"        $darkside = "DarkSide"    condition:        any of them}the results scared me since it’s a bunch on files detected by this rule.  thanks in advance for reading 

327
coolsport00
jcolonfzenpr
jcolonfzenprExperienced User
posted in YARA and Script Library
Veeam.Diagrammer upcoming improvements!

These diagrams are a sample of what I am working on in PowerShell for the next version of the Veeam.Diagrammer module. I am mainly working on generating diagrams of the Cloud Connect infrastructure and the composition of resources used by the tenants. Cloud Connect Infrastructure:Cloud Connect Infrastructure  Per Tenant diagram:Tenant5 Tenant4These improvements will also be part of the next version of the AsBuiltReport.Veeam.VBR report.The upcoming versions are going to be amazing!!!!!

9512
jcolonfzenpr
Marcel.K
Marcel.KVeeam Legend
asked in YARA and Script Library
Prolonging of backup images

Hello,we have many times request from customer to prolong backup images from 6 months to 1 year.I know, some complicated things like restore VM and provide backup again with 1 year or export this image, map to backup job and setup copy job with one year.Does exist any command in PowerShell to change expiration date?thank you

5311
D
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Data Integration API – File Scanner with Malware and LOLBAS Detection

Hello Community!Your input is needed. Almost two years ago, I created a PowerShell script that checks if one of the scanned files matches a SHA256 value by comparing the values to a list of known hash values. It only searched in specific directories.What would be better than using file-level restore? Right, Data Integration API!Since version 12.3.1, Veeam offers the possibility of working with the Data Integration API via the REST API. To improve the whole thing, I have created a Python script that scans the mounted backup file system for suspicious files by comparing their hash values against known threats stored in a local database. The database uses data from Malware Bazaar and the LOLBAS project (“Living Off The Land Binaries and Scripts”), a catalog with legitimate Windows system binaries that attackers often abuse. The script can detect such files when they appear in unusual locations. The analysis is performance-optimized through parallel processing and will export the result in

1277
Marcel.K
AndreAtkinson
AndreAtkinsonVeeam MVP
posted in YARA and Script Library
Dynamically Download Yara Rules

Hi All,Wasnt sure where to post this so adding it here.Had a requirement recently to automate the process of adding YARA rules and found that ransomware.live has a great list! fantastic resources for those that havent looked at it yet.leveraging their API, I basically pull the rules and then copy them to the VBR server, pretty simple but hopefully going to improve it as things move on but figured id share with the wider team.https://homelabpro.xyz/posts/2025-05-09-dynamically-download-yara-rules/

1072
Chris.Childerhose
SashoB
SashoBNot a newbie anymore
asked in YARA and Script Library
Yara rules repository

Hi,Where do you guys mostly download Yara rules for Veeam from?This GIT looks not maintained for years (files from 2022).  https://github.com/YARA-Rules/rules/archive/refs/heads/master.zipI also used those links but I had some troubles when scanning backup.https://github.com/Neo23x0/signature-base/archive/refs/heads/master.ziphttps://yaraify.abuse.ch/yarahub/yaraify-rules.zip

37111
coolsport00
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Quickly Check Backup Job Encryption Configuration Settings using PowerShell

Backups store important data, and if they are not protected, anyone who gets access can read them. Encrypting backups ensures that if someone gains access to backup files, they remain unreadable without the proper encryption key.Checking if backup jobs are configured to encrypt the backup data can sometimes be difficult, especially if there are many backup jobs. To simplify this process, I created a PowerShell script that helps to check the backup job encryption configuration settings quickly. The script retrieves information for the following Veeam backup job types:VMware Backup Agent Backup File Backup Object Storage BackupPowerShell sample output for Jobtype “File Backup”The output displays details such as the repository name and path, the encryption status (Encryption enabled/Unencrypted), the encryption key type, and the last modification date of the used encryption key.Check out the GitHub Repository for the complete documentation and the code.What’s next?I am creating a similar

3154
Tommy O'Shea
andy.sturniolo
andy.sturnioloComes here often
posted in YARA and Script Library
Unveiling Cyber Threats: Harnessing YARA and Veeam for Malware Detection! - Part 2

Hello everyone. Last time we explored how to identify basic file Indicators of Compromise (IoCs), develop YARA rules to detect malicious actors, and incorporate these rules into Veeam Backup & Replication to identify potential malware in our backups.Taking it a step further, today we will explore how to automatically generate YARA rules using YarGen. YarGenYarGen is a tool that generates YARA rules from a specified malware file. It identifies unique strings within the malware and excludes those prevalent in non-malicious files. This is achieved using YarGen's comprehensive database of strings and opcodes typically found in non-malicious files. Essentially, it creates YARA rules from strings in malware files while discarding those also present in goodware files.There are many variable and options that can be set in YarGen, today we are going to look at how it can create a YARA rule based off of a potential malware file. Back to basics - IoCSA user has noticed a folder called “freest

4686
AndreTheGiant
Martin Weber
Martin WeberComes here often
posted in YARA and Script Library
Pre-Check for update VEEAM to Version 12 using VMware

Hello together,before you update VEEAM to Version 12 using VMware vCenter/ESXi please check VMs HardDisks for duplicate UUID. In Version 11 this was never a problem. In the new Version VEEAM checks the UUID and backup will fail.VMware has no problem with that most time. But they know the Problem - https://kb.vmware.com/s/article/2006865This command will find any HardDisk with duplicate UUID - please note that this is VMware PowerCLI commandGet-VM | Get-HardDisk | Select @{N='VM';E={$_.Parent.Name}}, @{N='Uuid';E={$_.ExtensionData.Backing.Uuid}} | Group-Object -Property Uuid | ?{ $_.Count -gt 1 }As Service Provider such changes in VEEAM are a total disaster!!

144537
AndrePulia
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Veeam Backup & Replication 12.3 - New REST API features & new Python scripts

Veeam Backup & Replication 12.3 – A big release with many new functions. Let me show you some of the exciting new possibilities with REST API. And yes, I have also created some scripts 😉Scanning Backups & Veeam Threat HunterVeeam Backup & Replication offers various methods of scanning backups for malware. The Secure Restore feature allows for malware scanning during recovery, preventing the reintroduction of infected files. The Scan Backup functionality will enable you to check backups for malware on-demand. SureBackup provides the possibility to execute this task on a regular or even continuous basis.With the introduction of the Veeam Threat Hunter in Veeam Backup & Replication 12.3, the scanning capabilities become even more powerful. Read the Veeam Backup & Replication v12.3 - What’s new document (page 7) describing the Veeam Threat Hunter capabilities.❗Don’t forget to select the Veeam Threat Hunter in the Malware Detection Settings.Scan Backups using REST APIWi

6365
Geoff Burke
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
VBR Generate Syslog Event Filter XML File

Starting with Veeam Backup & Replication 12.3, it is possible to exclude specific events from being sent to the Syslog server. This can be done manually per event, or you can import an XML file with the events to be filtered.Handling this task and finding the necessary information can be time-consuming. Executing this task manually is “boring” and error-prone, so I created a simple PowerShell script to make the process easier by generating an XML file based on your chosen filters. Whether filtering by event IDs, categories, or specific filter types like Info, Warning, or Error, this script makes this task more fun.🕺🏿💃🏽For more details and examples of usage, check out the README in my GitHub repository.Happy filtering - It’s the most wonderful time of the year to write scripts 😉🎶Steve💚  

732
Chris.Childerhose
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - OneDrive for Business File Scanner

Hello Community!It's been two years since I published a script for a OneDrive for Business file check in this community. And even back then I had the code ready that also checks recovered files for possible malware. Of course, Microsoft 365 also has certain mechanisms, which are documented here.Trust is good, control is betterI have now taken up my idea again and packed it into a new script. The script restores files from the lastest OneDrive for Business restore point and scans them for threats using Windows Defender. A single file can also be restored and scanned.There is a "beautiful" listing when the scan has detected something.Please read the README document on my GitHub for more details on how to use the script.⛔Important!⛔ Make sure that there is sufficient disk space in the directory where the files are to be restored. Also use an empty directory to save the data, as the script cleans everything up after execution.Question to the communityWhat do you think of a script that rest

1053
vAdmin
J
Jeroen Buren EFCINew Here
asked in YARA and Script Library
Create NAS backup job with PowerShell

Hi everyone, I'm using Veeam for quite a while now but recently we added some NetApp ONTAP devices to the storage infrastructure. And for each also a NAS Filer object under unstructured data. I can select a NAS Filer and create a file backup job easily. But I want to automate this if possible.I can use Get-NetAppHost to get the ONTAP device and then use Get-VBRUnstructuredServer combined with Get-VBRNASServerPath but I can't link it all together… Also, when I look at an already configured job I cannot reverse engineer this to usable PS code.Can someone point me in the right direction to create a file backup job of a share on a NAS filer with PowerShell?

922
Chris.Childerhose
T
ThePlaneskeeperNot a newbie anymore
posted in YARA and Script Library
Immutable Storage actual disk used per folder

Inherency:Since we bill by actual disk usage for our client utilizing CloudConnect, the existing reports are non-functional for reporting and billing (They report pre-deduplication/reflink data).  It took a while to figure out, but there is a way to calculate actual disk space used on a per directory on an immutable repository.Solution:Using: https://community.veeam.com/blogs-and-podcasts-57/check-reflink-and-spared-space-on-xfs-repositories-244 I have extrapolated a script that will give the disk usage of each folder (IE: client) on an immutable repo.  This isn't "Data used"; that is what Veeam reports.  This is "Disk Used".  The actual size on disk after reflinks (duplicated data is only counted once). A note about this script; it appears that the original blog entry is wrong on the size of a block.  They attribute it to 4096... which is true... on disk... but the utility used explicitly gives the information in block sizes of 512:https://linux.die.net/man/8/xfs_bmap"units of 512-byt

155415
A
Link State
Link StateVeeam Legend
posted in YARA and Script Library
How to automate Veeam.Backup.Validator.exe powershel script V12

Hello everyone, as per my previous post.How to atomate & schedule Veeam.Backup.Validator.exe | Veeam Community Resource Hub I am proceeding as promised to update the schedulable veeam validator script. enjoiy 😁### Veeam Backup Validator - v.2.0 18-10-2024## USAGE:## > veeam-BackupValidator2.ps1 <jobName> <serverName> <Switch>## Switch:# -noTicket -> does not send mail to your system ticketing\servicedesk after Validate is completed## e.g.# > veeam-BackupValidator2.ps1 ‘Yout-Job-name-01’ ‘Yout-Job-name-02’ -notTicket no mail###PARAM (# [string] $customer = "YOUR CUSTOMER NAME", [string] $jobName = '*', [string] $serverName = '*', [switch] $noTicket )## -- Enter the customer name identifier here ($customer = "YOUR CUSTOMER NAME") --$customer = "YOUR CUSTOMER NAME"##$email_infoTO = "youtmail@yourdomain.com"$email_infoFrom = "$($env:COMPUTERNAME)@iyourdomain.com"$email_infoServer = "your.smtp.com"$email_subject = "[$customer] Backup Validation"$logfolder = "

1663
waqasali
F
fjlComes here often
asked in YARA and Script Library
Prompt for upgrade and update. After scanning, it prompts that the file does not exist. What should be done?

提示升级和更新。扫描后，它会提示该文件不存在。应该怎么做？我觉得这个需要手动更新，我不知道该怎么办 

245
Chris.Childerhose
jcolonfzenpr
jcolonfzenprExperienced User
posted in YARA and Script Library
Diagramming the Veeam Backup & Replication Infrastructure

Hello, As you may know I have been working for some time with several tools to document or diagram the Veeam Backup & Replica Infrastructure. In the latest version of Veeam.Diagrammer the ability to generate a diagram of the infrastructure has been added. Here is the link:https://techmyth.blog/posts/veeam-diagraming-infra/ Greetings from the Caribbean :) 

144061
MarcoLuvisi
Timothy Dewin
Timothy DewinComes here often
posted in YARA and Script Library
Veeam Hardened Repo: Firewalld security zones

Disclaimer: This is only provided as a reference. Make sure you understand what you are doing before executing this in your own setup (eg test in a lab). Since this is modifying the firewall, you might lock yourself out remotely if you are executing the steps incorrectly or you have a slightly different setupIf you are running RHEL or any experimental derivative (in my case Rocky 8.8), you can use firewalld to configure the firewall. Firewalld uses zones in which you can allow ports or services based on the incoming interface or IP sources. By default, all the traffic is “allowed” based on the rules in the public zone (or better the interfaces are by default assigned to the public zone). You can test this with# What is the default zonefirewall-cmd --get-default-zone# What are the active zones, by default only the public zonefirewall-cmd --get-active-zones# List all the rules in the public zone, this is by default ssh cockpit and dhcpv6firewall-cmd --zone=public --list-allYou can howeve

16003
K
tarik.yenisey
tarik.yeniseyVUG Leader
asked in YARA and Script Library
Veeam Yara Rules - Malware Scan

Hello everyone, First of all, I would like to ask my community because I am not fully familiar with Yara rules. When scanning for Malware Detection with Yara rules, can you see which files have Malware in which locations with Yara Rules? When I do a direct Malware scan, if there is malware, it shows the machine under the malware tab but does not give details. What can I do for more details here Hello everyone,

2971
Chris.Childerhose

Badge winners

Show all badges
Terms & Conditions