Skip to main content

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 170 Topics
  • 920 Comments
169 Topics
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Veeam Usage Report for VMware Cloud Director

Deprecated: This script will not work with Veeam Backup & Replication v12. For v12 support, please use the VSPC-HostedUsage scripts. The PowerShell script to retrieve Veeam backup usage for VMware Cloud Director (VCD) Organizations is now available on VeeamHub! Below is a brief description of its functionality. For more detailed information, please follow the VeeamHub link. For each organization, the following is provided: Total number of VMs in backups Total amount of space used in repositories The usage data can be aggregated on the Organization-level or the Org VDC-level. This is useful when backups for different Org VDCs are billed differently. The scope of the usage returned is also customizable. It can be limited to self-service backups, created by the Veeam Self-Service Portal (VSSP) for VCD, or it can also include backups created directly on the backup server by the provider. NOTE: Before using this script in a production environment, I recommend you verify that numbers match u

2472
A
D
dionmitchell
asked in YARA and Script Library
Set-VBRViReplicaJob : Broker service has not started hierarchy collection for host

Hi All, I recently migrated some replicated VM’s on our VMWare infrastructure to a new DVSwitch and updated VLAN names, so I had to update all the Veeam replication jobs, when i tried to automate this using the Veeam powershell library I got the following error on 95% of the jobs. I did a little investigation but didnt manage to figure out what the difference was between all the failed jobs and the 3 that successfully updated. Has anyone ever seen this error message before ? Set-VBRViReplicaJob : Broker service has not started hierarchy collection for host xxxxx Here is a simplified version of the script i was using: # get all replication jobs$jobs = Get-VBRJob | Where-Object TypeToString -eq "VMware Replication" foreach ($job in $jobs) { $jobOptions = Get-VBRJobOptions -Job $job # get list of network objects on new target dvswitch $destSwitchNets = Get-VBRViServerNetworkInfo -Server "<server with new dv switch>" | Where-Object SwitchName -eq "NEW SWITCH" # build array of source and de

7025
Chris.Childerhose
Cjr20172
Cjr20172Not a newbie anymore
asked in YARA and Script Library
Reporting machines without backup in the last 30 days

I was wondering if there is a way to use PowerShell to determine if a machine in a protection group has not backed up in the last 30 days. Obviously in Inventory there are protection groups that have machines in them and a status of “Last Agent Backup”. Is it possible to generate a report that displays that information? Basically I would like to put the script into task scheduler and have it run the 2nd and the 24th of every month. Any advice? # Load Veeam PowerShell ModuleImport-Module Veeam.Backup.PowerShell # Define protection group names$protectionGroupNames = @("Example Protection Group", "Example Protection Group 2") # Get the current date and time window$timeWindow = (Get-Date).AddDays(-30) # Initialize array to store report data$reportData = @() foreach ($groupName in $protectionGroupNames) { # Get the protection group $protectionGroup = Get-VBRProtectionGroup -Name $groupName # Get details of the machines in the protection group $machines = Get-VBRDiscoveredComputer -Protectio

30223
Chris.Childerhose
Rick Vanover
Rick VanoverRICKATRON
published in YARA and Script Library
Featured YARA rule: Top 10 Ransomware Threats

Now that V12.1 is available, I wanted to share with you a featured YARA rule set that can give you on-demand scanning for some top ransomware threats. Attached to this post is a file named: Top10RW_YARArules.zip. In this file are YARA rules for some common ransomware threats that have been seen recently: Attribution: This great collection was made by Felix Bilsten. Links: X: Felix Bilstein (@fxb_b) / X (twitter.com), website: Felix Bilstein - project overview (cocacoding.com) and Github: fxb-cocacoding (Felix Bilstein) · GitHub

229214
M
damien commenge
damien commengeVeeam Legend
posted in YARA and Script Library
Get all malwares detections

Hello, With some people help me, I have this "script" to get all differents malwares detections based on date + VM name + Path.This is usefull to avoid read several files. $Path = "C:\ProgramData\Veeam\Backup\Malware_Detection_Logs\"$Files = (Get-ChildItem -Path $Path).FullName Select-String -Path $Files -Pattern '^\[(?<Date>[^\]]+).+\s(?<VM>[^:]+):.+?:(?<File>.+)' -AllMatches | ForEach-Object { $match = $_.Matches[0] [PSCustomObject]@{ Date = $match.Groups['Date'].Value VM = $match.Groups['VM'].Value File = $match.Groups['File'].Value } } | Sort-Object VM, File -Unique

2193
Mahmood.Alganadi
J
JestyrNot a newbie anymore
asked in YARA and Script Library
Need advice on speeding up retrieval Backup stats via PowerShell

Hi, everyone! I have a PowerShell script that I use to retrieve some information about the daily backup sessions. It works well, but I was trying to transition it from the Get-VBR-Job command to the Get-VBRBackup command. Everything works but the newer script is very slow; it went from a few seconds with the old script to 5-10 minutes with the new. I was wondering if anyone could give me pointers on a more efficient way to get the session information or otherwise speed it up. Thanks in advance!! Robb Original script #backup Jobs Foreach ($JobObject in Get-VBRJob){ #write-host "loop number ${$jobobject.indexof()}" $session=$jobobject.FindLastSession() if (!($JobObject.JobType -eq "BackupSync")) { $JobOutput = New-Object -TypeName PSObject if (((get-date).AddDays(-1) -lt $session.Progress.StopTimeLocal) -or ($session.Result -in "Failed","None")) { $JobOutput | Add-Member -Name "Job Name" -MemberType Noteproperty -Value $JobObject.Name $JobOutput | Add-Member -Name "Start Time" -MemberTyp

3548
J
jcolonfzenpr
jcolonfzenprExperienced User
posted in YARA and Script Library
New Release of AsBuiltReport.Veeam.VBR v0.8.6

Hello Community! Recently several changes were added to the AsBuiltReport.Veeam.VBR script that allow to improve the documentation process of Veeam B&R infrastructure. On this occasion, several bugs were fixed and a new feature was added to generate a diagram of the implemented components in the Veeam Backup & Replication infrastructure. Here are the new changes: https://techmyth.blog/posts/abr-veeam-vbr-0_8_6/ In addition I provide the following links so that you can see the sample report and an example of the infrastructure diagram. Sample Report Infrastructure Diagram: Hasta la proxima! 😎

1591
Chris.Childerhose
ratkinsonuk
ratkinsonukComes here often
asked in YARA and Script Library
Powershell COM Help

Forgive me, as this isn’t strictly a Veeam topic, but I’m pulling my hair out. I’m trying to enhance a Windows Update Powershell script. The current script occasionally hangs when we invoke a COM CreateUpdateSearcher() method. $updateSession = new-object -com "Microsoft.Update.Session"$Criteria = "IsInstalled=0"$updates = $updateSession.CreateupdateSearcher().Search($criteria).Updates This runs synchronously, so I can’t trap the hang. Instead, I want to use the BeginSearch() method that runs asynch (https://learn.microsoft.com/en-us/windows/win32/api/wuapi/nf-wuapi-iupdatesearcher-beginsearch). My problem is it requires an ‘IUnknown ISearchCompletedCallback’ object to be passed as one of the parameters. I don’t need this to be invoked, so it can be an empty object, but I can’t work out how to create an empty IUnknown object. $UpdateSession = New-Object -ComObject "Microsoft.Update.Session"$objSearcher = $UpdateSession.CreateUpdateSearcher()$objSearch = $objSearcher.BeginSearch('IsInsta

922
ratkinsonuk
R
Ricardo MazzarelloNot a newbie anymore
asked in YARA and Script Library
Veeam Backup & Replication- Powershell script for retrieve all backup jobs parameter

Hi, Good evening. I am analyzing different Veeam Backup & Replication instances and I would like take all parameters for every backup job present on every VB&R instances that I am analyzing. I would like to know if is possible launch one powershell script for retrieve these values for example: start time for every schedule job, servers involved, backup modality (full, incremental, reverse incremental, etc) aware setting if exist, etc. Thanks in advance. Best regards Ricardo

11166
SteveHeart
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - VBR 12.1 - Guest Index Data Scan Manager

Intro First of all: Happy new year to everyone! With Veeam Backup & Replication 12.1, many new security features have been added. One of these is the Guest Index Data Scan. For this, Veeam Backup & Replication uses a signature-based approach. During/after the backup job, the following malware activity can be detected: - Malware signatures specified in the "C:\Program Files\Veeam\Backup and Replication\Backup\SuspiciousFiles.xml" on the backup server- Multiple files renamed by malware- Multiple files deleted by malware Please read the Help Center documentation to learn more about the details and how it works. In addition to the XML file, manual customization is also possible. You can add a malware signature that is marked as suspicious (Suspicious files) or that should be skipped (Trusted files) during the scan. See here. Questions you might ask But how do you know how many "built-in" and how many manually entered entries there are? Of course you can check the manual settings in the GUI

2095
vAdmin
dips
dipsVeeam Legend
posted in YARA and Script Library
YARA Rule for CVE-2024-3094

Hi Folks, Following on from the news regarding a backdoor in the Linux library xz, a Yara Rule is now available that can be used in Veeam 12.1 if you do not utilise a vulnerability scanner in your environment. Great way to check by leveraging Veeam to do the scanning for you. There is more info about the vulnerability on the post by @JMeixner : Yara Rule can be found here: https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar

5840
dips
leduardoserrano
leduardoserranoOn the path to Greatness
asked in YARA and Script Library
VDC 365 Data Residency in Brazil's South Azure Region

Hi Community team! I have a doubt regarding the availability of VDC 365 Data Residency in Brazil's South Azure Region. I didn´t find this information in the documentation. The service´s docs state that backup data created by Veeam Data Cloud for Microsoft 365 or Veeam Data Cloud for Microsoft Azure can be targeted to and reside in any Azure region as end users request. Metadata is encrypted and stored in one of the following Azure regions: United States West. United Kingdom South, or Australia East. Do you know if storing the backups in Brazil's South Region in an LRS redundancy schema is possible? Choose the Right Azure Region for You | Microsoft Azure Thanks so much for your help!

671
leduardoserrano
A
AlexSimpsonNot a newbie anymore
asked in YARA and Script Library
Powershell for getting members of Physical Infrastructure

I have a pretty simple request that I just can’t seem to identify the correct command for. I’m just looking to be able to query what job a system is a member of. It’s very easy to do for any virtual systems, but harder for physical. Connecting and getting the job are easy. And the $Job.BackupObject property contains the Physical Infrastructure object I’m interested in, but not the actual members of the Physical Infrastructure box. The script: The Physical Infrastructure Object: The contents I’m really trying to get:

752
damien commenge
E
EdxHComes here often
posted in YARA and Script Library
vcli - a universal Veeam CLI tool

Hi all, I’ve been toying around with the idea of a cli tool that works with everything and is related to the other post I put up today on the Go-Veeam-Auth that does authentication for all Veeam APIs. Anyway, I’ve come up with vcli a simple terminal app written in Go, allowing you to switch between APIs with minimal effort quickly. All the authentication is set up, so all you need to do is set some environmental variables, and off you go (no pun intended). The main output is JSON, but you can switch it over to YAML via a --yaml switch. The tool only does GET requests at the moment, as I wanted to gauge the interest before committing any more time to the project. Where the power really comes in when it is coupled with “nushell” which is a data-centric approach to shells. It makes manipulating json response objects a breeze and also allows conversion to other data formats. It also has a whole module system which I go into a bit on my GitHub. GitHub page: https://github.com/shapedthought/

40210
k00laidIT
andy.sturniolo
andy.sturnioloComes here often
posted in YARA and Script Library
Unveiling Cyber Threats: Harnessing YARA and Veeam for Malware Detection!

Greetings, everyone! Today we'll delve into the art of identifying basic file Indicators of Compromise (IoCs), crafting YARA rules to sniff out malicious actors, and seamlessly integrating these rules into Veeam Backup & Replication to safeguard our backups against potential malware threats. But before we dive in, let's take a moment to understand YARA and what its for. YARA YARA is an open-source malware classification tool used to identify and classify malware or suspicious files based on its signatures or rules. It is a powerful and flexible tool that allows users to create rules matching their organization’s needs or targeting specific threats. Moreover, YARA rules are like a piece of programming language, they work by defining a number of variables that contain patterns found in a sample of malware. If some or all of the conditions are met, depending on the rule, then it can be used to successfully identify a piece of malware. Indicators of Compromise (IoCS) Suppose one day a user

9766
Stabz
skitch210
skitch210Veeam MVP
posted in YARA and Script Library
AIX Agent Auto Install

This is a Powershell Script that can be used to install and configure Veeam AIX Agent without needing to log into the AIX system. Can be because of lack of AIX expertise or a large number of AIX systems. https://github.com/VeeamHub/powershell/tree/master/BR-AgentAIX-Install

1013
Jean.peres.bkp
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Automated Upgrade to Veeam Backup & Replication v12.1

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12.1 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub. https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12.1 If you’re familiar with my previously written upgrade script for v12, here’s a summary of enhancements in this latest release: Added support for new silent upgrade process available in version 12.1 Veeam Backup & Replication Veeam Backup Enterprise Manager Added ISO validation as the script was written for a v12.1 ISO This will prevent an admin from accidentally using an incorrect ISO If you're a VCSP, the script can also be used for Cloud Connect environment upgrades.

3723
Nico Losschaert
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Veeam Collection for Ansible: v12.1 support

Support for the v12.1 (VBR/EM) is now available in the Veeam Collection for Ansible! Veeam Backup & Replication 12.1 is an incredible release jam-packed with goodies! Among those is a brand new process for installing & upgrading Veeam Backup & Replication, Veeam Backup Enterprise Manager, and the Veeam Backup & Replication Console. I’m happy to report this collection fully supports this process! Please review the below changelog for more detailed changes in this release: Breaking Changes Changed default ISO checksum algorithm from SHA256 to SHA1 As Veeam’s website doesn’t provide SHA256 checksum, this only made sense to change. Major Changes Added support for new silent install process available in version 12.1 Added support for new silent install process available in version 12.1 Added support for Veeam Backup & Replication Console 12.1 install Added support for Veeam Backup & Replication Console 12.1 upgrade Minor Changes Updated ISO to version 12.1 Updated logic for ISO download As

5237
leduardoserrano
CptAmerica
CptAmericaComes here often
posted in YARA and Script Library
Enable/Disable Health Checks for Multiple Jobs

UPDATE (Feb 2024): It was brought to my attention recently that some of the cmdlets have changed in v12.x that may have broken one or more of the above scripts. I’ve rewritten the one that was pointed out (Veeam Agent Jobs) and tested to make sure it works. I can’t vouch for the others, but will try to get around to updating them all (if needed) and posting the updates here. Just be sure if you’re on 12.x or newer that you do thorough checks to confirm it works in a safe environment before attempting to run anything in production. ------------------------------------------------------ Hello again, everyone! Just sharing another useful PowerShell script to enable/disable Health Checks for multiple jobs. It’s handy whenever you have a large number of jobs which all need to be adjusted and would take a significant amount of time to do so. Usually I wouldn’t share such a short script, but the way to locate and adjust this particular option in a job via PowerShell can be a little confusing

9506
Chris.Childerhose
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - Automating Tape Verification in Veeam Backup & Replication

A tape verification a day….😉 Tape backups are an essential part of data protection strategies as they provide reliable security and offline storage capabilities. However, ensuring the reliability and consistency of tape backups can be critical for regulatory compliance and ensuring data integrity. So I wrote a Powershell script (which has been floating around in my head for a long time) that uses the available Powershell cmdlet "Start-VBRTapeVerification" to regularly check tapes available in a media pool and marks them as checked with time stamps and checks the tapes again after a certain time (default 270 days). It also helps to increase data reliability and reduces the manual effort involved in managing tape backups. The script can be downloaded here. The following parameters can be utilized to customize the tape verification: MediaPool: Specifies the media pool from which tapes will be selected for verification. This parameter is mandatory. NumberofTapes: Determines the number of

5313
Chris.Childerhose
S
skbro27New Here
asked in YARA and Script Library
Monthly Veaam Backup report - html

Looking for backup report script to output to html. Currently not veaam one in the environment.

3742
coolsport00
BertrandFR
BertrandFRInfluencer
posted in YARA and Script Library
script for an immutable configuration backup on linux

Hello, I could say better late than never, i’m using a script since many years to make my configuration configuration immutable on a linux repos.Even it is now available for object storage and it will probably be immutable in future release, i think it could useful to share it. #!/bin/bash # Define a list of target directoriestarget_directories=("/path/to/your/target_directory1" "/path/to/your/target_directory2")attribute_to_apply=" +i" # The chattr attribute to apply (e.g., immutable)time_to_wait_days=10 # Time to wait in days before removing chattr attributelog_path="/path/to/your/logfile.log" # Replace with your desired log path # Calculate the time to wait in secondstime_to_wait_seconds=$((time_to_wait_days * 24 * 60 * 60)) # Log the start timeecho "$(date): Chattr attribute application started for files in ${target_directories[*]}" >> $log_path # Loop through all target directoriesfor target_directory in "${target_directories[@]}"; do # Loop through all files in the target directo

2743
Chris.Childerhose
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - VBR Backup Scan - Updates

Hello community,you probably know my many scripts on the subject of backup data scanning? I am happy to share with you what I am currently working on. Secure Restore / Scan Backup Currently "only" Microsoft Windows machines can be scanned using Secure Restore or Scan Backup (see here). However the Disk Publishing (Data Integration API) allows us to publish a disk from different types of backups to a Windows or Linux host. The disk can have a Microsoft Windows, Linux, Unix or other file system. On top Veeam Backup & Replication v12.1 gives us many more options for scanning backup data. For example we now also can mark restore points as clean, suspicious or infected using a PowerShell cmdlet. What if i were to extend one of my scripts with this function? Said and done! New Script - New Features The new script presents all existing restore points from a Linux VM, Windows VM or Agent backup to a Linux host, scans the specified restore point and marks the selected restore point as infected,

3992
Chris.Childerhose
MarcM
MarcMNew Here
posted in YARA and Script Library
Powershell - VBR - YARA Rules updater

Hi Community, YARA Scans, one of the exciting new features in V12.1 that I really wanted to start using.YARA is a great tool to help you search and detect malware like ransomware and alert you before it can do any damage. In Veeam Backup and Replication V12.1 you can only select one .yar/.yara file to use for scanning from the "C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules" directory on the Backup Server.After uploading some YARA Rules to my Backup Server, I created an index.yar to include all the individual files/rules so I can run scans using all my YARA rules instead of a single YARA rule. A Yara rule looks like this: Where a Yara index file looks like this: If you select a file with an actual YARA rule the scan works fine, but since the file I selected was my index.yar file, the scan failed! After taking a close look at the YARA-Volume0.log file in (my case in) "C:\ProgramData\Veeam\Backup\FLRSessions\Windows\FLR__vb365.veeam.lab_\Antivirus" on the Mount Server I f

9391
leduardoserrano
K
keironbellNot a newbie anymore
posted in YARA and Script Library
Automate Bulk Upgrade of VBR via VSPC

Last month I created a topic for a script I had created using Veeam Service Provider Console API to automate the upgrade of Veeam Agents (Automate Veeam Agent Upgrades via VSPC | Veeam Community Resource Hub) which also got featured in the last recap of 2023 which was a very nice end to the year for my first post! I was already planning on working on a script to automate the process of bulk updating VBR servers, but after it was mentioned a couple of times, I thought I would share what I have so far. If, like me, you work for an MSP, we have multiple tenant VBR’s kicking around it can be very time consuming when a new upgrade for Veeam comes out, to get this deployed on all of our tenants servers. Luckily, in recent updates, VSPC has improved the process of remotely upgrading VBR via VSPC. However, it is still a manual process that can still be time consuming going through each tenant VBR Server one by one. I wanted to find a way to automate this process. I could of wrote a script that

3412
Chris.Childerhose

Categories

Community
News
General Information
Blogs and Podcasts
YARA and Script Library
Discussion Boards
VeeamON Events
Security Blueprints
Veeam University
Veeam Technical Specialist

Most active members of the week

Badge winners

Show all badges

Popular tags

Terms & Conditions