YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

163 Topics
869 Comments

163 Topics

VDC 365 Data Residency in Brazil's South Azure Region

Hi Community team! I have a doubt regarding the availability of VDC 365 Data Residency in Brazil's South Azure Region. I didn´t find this information in the documentation.The service´s docs state that backup data created by Veeam Data Cloud for Microsoft 365 or Veeam Data Cloud for Microsoft Azure can be targeted to and reside in any Azure region as end users request. Metadata is encrypted and stored in one of the following Azure regions: United States West. United Kingdom South, or Australia East.Do you know if storing the backups in Brazil's South Region in an LRS redundancy schema is possible?Choose the Right Azure Region for You | Microsoft AzureThanks so much for your help!

5 months ago

AlexSimpsonNot a newbie anymore

asked in YARA and Script Library

Powershell for getting members of Physical Infrastructure

I have a pretty simple request that I just can’t seem to identify the correct command for.I’m just looking to be able to query what job a system is a member of. It’s very easy to do for any virtual systems, but harder for physical. Connecting and getting the job are easy. And the $Job.BackupObject property contains the Physical Infrastructure object I’m interested in, but not the actual members of the Physical Infrastructure box.The script:The Physical Infrastructure Object:The contents I’m really trying to get:

5 months ago

EdxHComes here often

posted in YARA and Script Library

vcli - a universal Veeam CLI tool

Hi all, I’ve been toying around with the idea of a cli tool that works with everything and is related to the other post I put up today on the Go-Veeam-Auth that does authentication for all Veeam APIs. Anyway, I’ve come up with vcli a simple terminal app written in Go, allowing you to switch between APIs with minimal effort quickly. All the authentication is set up, so all you need to do is set some environmental variables, and off you go (no pun intended).The main output is JSON, but you can switch it over to YAML via a --yaml switch.The tool only does GET requests at the moment, as I wanted to gauge the interest before committing any more time to the project. Where the power really comes in when it is coupled with “nushell” which is a data-centric approach to shells. It makes manipulating json response objects a breeze and also allows conversion to other data formats. It also has a whole module system which I go into a bit on my GitHub. GitHub page: https://github.com/shapedthought/vc

5 months ago

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - OneDrive for Business File Scanner

Hello Community!It's been two years since I published a script for a OneDrive for Business file check in this community. And even back then I had the code ready that also checks recovered files for possible malware. Of course, Microsoft 365 also has certain mechanisms, which are documented here.Trust is good, control is betterI have now taken up my idea again and packed it into a new script. The script restores files from the lastest OneDrive for Business restore point and scans them for threats using Windows Defender. A single file can also be restored and scanned.There is a "beautiful" listing when the scan has detected something.Please read the README document on my GitHub for more details on how to use the script.⛔Important!⛔ Make sure that there is sufficient disk space in the directory where the files are to be restored. Also use an empty directory to save the data, as the script cleans everything up after execution.Question to the communityWhat do you think of a script that rest

6 months ago

andy.sturnioloComes here often

posted in YARA and Script Library

Unveiling Cyber Threats: Harnessing YARA and Veeam for Malware Detection!

Greetings, everyone! Today we'll delve into the art of identifying basic file Indicators of Compromise (IoCs), crafting YARA rules to sniff out malicious actors, and seamlessly integrating these rules into Veeam Backup & Replication to safeguard our backups against potential malware threats. But before we dive in, let's take a moment to understand YARA and what its for. YARAYARA is an open-source malware classification tool used to identify and classify malware or suspicious files based on its signatures or rules. It is a powerful and flexible tool that allows users to create rules matching their organization’s needs or targeting specific threats. Moreover, YARA rules are like a piece of programming language, they work by defining a number of variables that contain patterns found in a sample of malware. If some or all of the conditions are met, depending on the rule, then it can be used to successfully identify a piece of malware. Indicators of Compromise (IoCS)Suppose one day a us

6 months ago

skitch210Veeam MVP

posted in YARA and Script Library

AIX Agent Auto Install

This is a Powershell Script that can be used to install and configure Veeam AIX Agent without needing to log into the AIX system. Can be because of lack of AIX expertise or a large number of AIX systems. https://github.com/VeeamHub/powershell/tree/master/BR-AgentAIX-Install

6 months ago

andy.sturnioloComes here often

posted in YARA and Script Library

Unveiling Cyber Threats: Harnessing YARA and Veeam for Malware Detection! - Part 2

Hello everyone. Last time we explored how to identify basic file Indicators of Compromise (IoCs), develop YARA rules to detect malicious actors, and incorporate these rules into Veeam Backup & Replication to identify potential malware in our backups.Taking it a step further, today we will explore how to automatically generate YARA rules using YarGen. YarGenYarGen is a tool that generates YARA rules from a specified malware file. It identifies unique strings within the malware and excludes those prevalent in non-malicious files. This is achieved using YarGen's comprehensive database of strings and opcodes typically found in non-malicious files. Essentially, it creates YARA rules from strings in malware files while discarding those also present in goodware files.There are many variable and options that can be set in YarGen, today we are going to look at how it can create a YARA rule based off of a potential malware file. Back to basics - IoCSA user has noticed a folder called “freest

6 months ago

Chris.ArceneauxVeeam MVP

posted in YARA and Script Library

Automated Upgrade to Veeam Backup & Replication v12.1

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12.1 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12.1 If you’re familiar with my previously written upgrade script for v12, here’s a summary of enhancements in this latest release:Added support for new silent upgrade process available in version 12.1 Veeam Backup & Replication Veeam Backup Enterprise Manager Added ISO validation as the script was written for a v12.1 ISO This will prevent an admin from accidentally using an incorrect ISO If you're a VCSP, the script can also be used for Cloud Connect environment upgrades.

6 months ago

Chris.ArceneauxVeeam MVP

posted in YARA and Script Library

Veeam Collection for Ansible: v12.1 support

Support for the v12.1 (VBR/EM) is now available in the Veeam Collection for Ansible!Veeam Backup & Replication 12.1 is an incredible release jam-packed with goodies! Among those is a brand new process for installing & upgrading Veeam Backup & Replication, Veeam Backup Enterprise Manager, and the Veeam Backup & Replication Console.I’m happy to report this collection fully supports this process! Please review the below changelog for more detailed changes in this release: Breaking ChangesChanged default ISO checksum algorithm from SHA256 to SHA1 As Veeam’s website doesn’t provide SHA256 checksum, this only made sense to change. Major ChangesAdded support for new silent install process available in version 12.1 Added support for new silent install process available in version 12.1 Added support for Veeam Backup & Replication Console 12.1 install Added support for Veeam Backup & Replication Console 12.1 upgradeMinor ChangesUpdated ISO to version 12.1 Updated logic fo

6 months ago

CptAmericaComes here often

posted in YARA and Script Library

Enable/Disable Health Checks for Multiple Jobs

UPDATE (Feb 2024):It was brought to my attention recently that some of the cmdlets have changed in v12.x that may have broken one or more of the above scripts. I’ve rewritten the one that was pointed out (Veeam Agent Jobs) and tested to make sure it works. I can’t vouch for the others, but will try to get around to updating them all (if needed) and posting the updates here. Just be sure if you’re on 12.x or newer that you do thorough checks to confirm it works in a safe environment before attempting to run anything in production.------------------------------------------------------Hello again, everyone! Just sharing another useful PowerShell script to enable/disable Health Checks for multiple jobs. It’s handy whenever you have a large number of jobs which all need to be adjusted and would take a significant amount of time to do so. Usually I wouldn’t share such a short script, but the way to locate and adjust this particular option in a job via PowerShell can be a little confusing if

7 months ago

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - Automating Tape Verification in Veeam Backup & Replication

A tape verification a day….😉Tape backups are an essential part of data protection strategies as they provide reliable security and offline storage capabilities. However, ensuring the reliability and consistency of tape backups can be critical for regulatory compliance and ensuring data integrity.So I wrote a Powershell script (which has been floating around in my head for a long time) that uses the available Powershell cmdlet "Start-VBRTapeVerification" to regularly check tapes available in a media pool and marks them as checked with time stamps and checks the tapes again after a certain time (default 270 days). It also helps to increase data reliability and reduces the manual effort involved in managing tape backups. The script can be downloaded here.The following parameters can be utilized to customize the tape verification:MediaPool: Specifies the media pool from which tapes will be selected for verification. This parameter is mandatory. NumberofTapes: Determines the number of tape

7 months ago

skbro27New Here

asked in YARA and Script Library

Monthly Veaam Backup report - html

Looking for backup report script to output to html. Currently not veaam one in the environment.

7 months ago

BertrandFRInfluencer

posted in YARA and Script Library

script for an immutable configuration backup on linux

Hello,I could say better late than never, i’m using a script since many years to make my configuration configuration immutable on a linux repos.Even it is now available for object storage and it will probably be immutable in future release, i think it could useful to share it. #!/bin/bash# Define a list of target directoriestarget_directories=("/path/to/your/target_directory1" "/path/to/your/target_directory2")attribute_to_apply=" +i" # The chattr attribute to apply (e.g., immutable)time_to_wait_days=10 # Time to wait in days before removing chattr attributelog_path="/path/to/your/logfile.log" # Replace with your desired log path# Calculate the time to wait in secondstime_to_wait_seconds=$((time_to_wait_days * 24 * 60 * 60))# Log the start timeecho "$(date): Chattr attribute application started for files in ${target_directories[*]}" >> $log_path# Loop through all target directoriesfor target_directory in "${target_directories[@]}"; do # Loop through all files in the target dir

7 months ago

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - VBR Backup Scan - Updates

Hello community,you probably know my many scripts on the subject of backup data scanning? I am happy to share with you what I am currently working on.Secure Restore / Scan BackupCurrently "only" Microsoft Windows machines can be scanned using Secure Restore or Scan Backup (see here). However the Disk Publishing (Data Integration API) allows us to publish a disk from different types of backups to a Windows or Linux host. The disk can have a Microsoft Windows, Linux, Unix or other file system. On top Veeam Backup & Replication v12.1 gives us many more options for scanning backup data. For example we now also can mark restore points as clean, suspicious or infected using a PowerShell cmdlet. What if i were to extend one of my scripts with this function? Said and done!New Script - New FeaturesThe new script presents all existing restore points from a Linux VM, Windows VM or Agent backup to a Linux host, scans the specified restore point and marks the selected restore point as infected

7 months ago

MarcMNew Here

posted in YARA and Script Library

Powershell - VBR - YARA Rules updater

Hi Community,YARA Scans, one of the exciting new features in V12.1 that I really wanted to start using.YARA is a great tool to help you search and detect malware like ransomware and alert you before it can do any damage.In Veeam Backup and Replication V12.1 you can only select one .yar/.yara file to use for scanning from the "C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules" directory on the Backup Server.After uploading some YARA Rules to my Backup Server, I created an index.yar to include all the individual files/rules so I can run scans using all my YARA rules instead of a single YARA rule.A Yara rule looks like this:Where a Yara index file looks like this:If you select a file with an actual YARA rule the scan works fine, but since the file I selected was my index.yar file, the scan failed!After taking a close look at the YARA-Volume0.log file in (my case in) "C:\ProgramData\Veeam\Backup\FLRSessions\Windows\FLR__vb365.veeam.lab_\Antivirus" on the Mount Server I found

8 months ago

keironbellNot a newbie anymore

posted in YARA and Script Library

Automate Bulk Upgrade of VBR via VSPC

Last month I created a topic for a script I had created using Veeam Service Provider Console API to automate the upgrade of Veeam Agents (Automate Veeam Agent Upgrades via VSPC | Veeam Community Resource Hub) which also got featured in the last recap of 2023 which was a very nice end to the year for my first post! I was already planning on working on a script to automate the process of bulk updating VBR servers, but after it was mentioned a couple of times, I thought I would share what I have so far. If, like me, you work for an MSP, we have multiple tenant VBR’s kicking around it can be very time consuming when a new upgrade for Veeam comes out, to get this deployed on all of our tenants servers. Luckily, in recent updates, VSPC has improved the process of remotely upgrading VBR via VSPC. However, it is still a manual process that can still be time consuming going through each tenant VBR Server one by one. I wanted to find a way to automate this process.I could of wrote a script that

8 months ago

Link StateVeeam Legend

posted in YARA and Script Library

How to atomate & schedule Veeam.Backup.Validator.exe

Doc Veeam validatorKB2086: How to Use the Veeam Backup ValidatorVeeam Backup Validator - Veeam Backup Guide for vSphere It is essential to verify the status of the backups at the CRC level on the storage and the possibility of restoring them via Surebackup.During the wizard for creating a backup job you can enable "Storage backup files healt check (detect and auto-heals corruption. https://helpcenter.veeam.com/docs/backup/vsphere/backup_health_check.html?ver=110I prefer to automate the validation process to have a detailed report every 2 weeksCopy past and save .ps1 format <#.SYNOPSIS Performs a validation of all server backups.DESCRIPTION .NOTES File Name : veeam_validator.ps1 Author : Me and my colleague Prerequisite : PowerShell V2 , VeeamPSSnapIn installed#>#------------------------------------------ VARIABLES TO CHANGE -------------------------$email_infoTO = "yourmail@yourdomain.com"$email_infoFrom = "$($env:COMPUTERNAME)@ yourdomain.com "$email_

8 months ago

damien commengeVeeam Legend

posted in YARA and Script Library

Check and set Hardening on VBR server

Hello,I want to share with you the last script I make to get hardening configuration of the VBR server and then remediate some of them.The script need to be executed on the VBR server itself.It's built with Veeam 12.1 beta. That means some checks can break on GA version.I seperate it into 4 choices when you execute it :choice 1 = Apply Level 1 security (security check done by veeam product itself when you execute security and compliance on the VBR console)choice 2 = Apply Level 2 security (best practice about hardening Veeam product)choice 3 = Remove VBR console (Carreful, you can't use anymore Veeam powershell after this action)choice 4 = Get HTML security report That means choice 1 or 2 or 3 will performs modifications on the system.Choice 4 will not do any modifications, it just make the HTML report.Some sample available on fresh installation, fresh installation + L1 applied, fresh installation + L1 + L2 appliedIf you want to see report on fresh installation + after doing choice 1 +

8 months ago

Chris.ArceneauxVeeam MVP

posted in YARA and Script Library

Updated: Veeam Service Provider Console Storage Usage Report

I’m happy to announce that the storage report script, by @Jim Jones, has been updated for Veeam Service Provider Console v8 and is now available on VeeamHub.This script will return usage and metadata for all backup repositories for the specified VSPC server. It will also provide the name and UID of the provider/reseller/company to whom the repository belongs.Be on the lookout for the BackupSizeGB metric which was added in Veeam Service Provider Console v8. This metric is the total size of all restore points and is a useful chargeback metric for service providers.On top of that, this report could be used by operations to see the current status of all backup repositories in their environment.For more detailed information, please follow the VeeamHub link.https://github.com/VeeamHub/powershell/tree/master/VSPC-StorageReport

8 months ago

keironbellNot a newbie anymore

posted in YARA and Script Library

Automate Veeam Agent Upgrades via VSPC

One of the things I have been looking at recently is automating the process of upgrading Veeam Agents. The great thing with Veeam Service Provider Console is how easy we can bulk update agents from one place. However, I wanted to take it a step further and have this totally automated - mainly because I am lazy. To do so, I have used the VSPC API to do this for me. I am not the most proficient with PowerShell, someone can probably make this run more efficiently. However the below script works just fine for me, so thought I would share it with the community. I use this via an Azure Function that runs every morning and kicks off an upgrade of any agents that require it, however you could schedule this from a RMM product etc, whatever works best for yourself. At the moment there is no property in the VSPC API to show if an agent requires an upgrade, so it starts by adding this property by comparing the installed version to the current released version (this part you manually have to update

9 months ago

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - Restore VBR Configuration Database - V12.1

With Veeam Backup & Replication (VBR) 12.1 it is possible to restore the Configuration Database using Powershell. Basically a simple task, if there weren't a few things to consider. Challenge accepted!My SetupLet's prepare for the scenario where the primary VBR is no longer available and the configuration database needs to be restored on another system with a different hostname (standby VBR). On the primary VBR, the configuration backup was encrypted according to the best practices and MFA was also activated for part of the users. The configuration database runs on PostgreSQL.I had the following thoughts before creating the scriptCheck that only the necessary Veeam services are running on the standby VBR server Check if the response file has the proper entries (e. g. not automatically starting the Veeam services after the restore) When MFA is enabled/used, updates must currently be made to the database after restoring the configuration DB (see here) The encryption password should n

9 months ago

MikeLeoneComes here often

asked in YARA and Script Library

Using Powershell to query for online only tapes

Hello. We have a policy to export all tapes currently in a library that are marked FULL. I can get a list of all FULL tapes in a media pool like this:[String] $LibraryName = Get-VBRTapeLibrary | Select -Expandproperty Name$TapesToBeEjected = Get-VBRTapeMedium -Library $LibraryName | Where {$_.IsFull -eq "TRUE"} | Select Name, LastWriteTime, MediaPoolID | Sort -Property Name (there’s more to my script, but that is the relevant querying section) However, that gives me *all* tapes in the pool that are FULL, and I want only the tapes in a pool that are currently ONLINE in a library that are FULL (so it can send an email to the tape operators and tell them to go export the tape(s)). And I have not found a way to do that - I don’t see any property that is returned that shows ONLINE or OFFLINE of a specific tape. Am I just missing it? Is there way to query for this, so I can send an alert email (as a scheduled task)? Or is there some other way to do it? (we don’t have a license fo

9 months ago

louis_bab99New Here

asked in YARA and Script Library

Veeam V12 PostgreSQL Config DB SQL Queries fail

Hello, we are monitoring the customer backups via PRTG.Till now, we had a SQL Skript, wich got the latest result and reported it to PRTG:SELECT latest_result FROM bjobs WHERE name = @prtg;That worked fine with MSSQL Express, but now with PostgreSQL we have to use a PostgreSQL Sensor in PRTG. Thats no problem, but it always failes with: “GSS/SSPI authentication but IntegratedSecurity not enabled” when I try to use the postgres user, or with: 28000: SSPI-Authentication for user Administrator failed”. For debugging I tried to change the access settings in the pg_hba.conf file but nothing seems to work.Is there a way I can still run queries to the config database? Or do I have to go via the PowerShell Snappin from Veeam?PS: We don’t use the Enterprise Manager, because you need the Enterprise Plus license for that and our customers don’t have that license. Thanks alot.

9 months ago

SteveHeartVeeam MVP

posted in YARA and Script Library

Veeam Backup for Microsoft 365 - Azure/Entra Application Creation Script

A long time ago, my colleague @StefanZi had provided a Powershell script to create the necessary Azure/Entra appplicaton to be used in Veeam Backup for Microsoft 365. In the meantime, new permission requirements have been added to this application and the Powershell cmdlet AzureAD will also be retired next year (see here), and one of my Powershell scripts also requires the automated creation of an application in Azure/Entra.These were enough reasons for me to update the script. So what's new?- Use of the Microsoft Graph Powershell Module- Revise and add permissions- Adaptations to the text (e.g. adapted product name)- Optimize outputAnd the good news are. Script is ready to use. More details in my GitHub repository here.Enjoy!Steve

9 months ago

Bastiaan van HaastrechtNew Here

posted in YARA and Script Library

Get Veeam for Azure pending updates from API

Hi all, Currently there's no indication other then on the VBA appliance itself that there are pending updates. Therefore I created a PS script which we integrated into our monitoring system (N-Central) that pulls this data from the appliance. We get notified for pending updates and we can proceed to deploy them. You can find the script on my gist page: https://gist.github.com/BasvanH/cc7cb3974657bde5926af69869e73b0b Two variables are filled with the status:$pendingUpdates is a integer and filled with the pending update count$updateCategories is a string and filled with the categories of the pending updates. You can adjust the script to your needs. All the best, regards,Bastiaan

10 months ago

Page 2 / 7

YARA and Script Library

Badge winners

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded