YARA and Script Library

Update from @Chris.Arceneaux (Nov 7th, 2022):Chris has created a new script to automate the commands described in my topic. Thank you very much. :)https://github.com/VeeamHub/powershell/tree/master/VB365-CheckTeamsProtectedAPI______________________ My code has the added benefit of not requiring parameters (TenantID/AppId/CertThumbprint) to be specified as long as the script is executed on the VB365 server. It also automagically installs required PowerShell module(s). This script is about KB4322 (Using Microsoft Graph Export API for Teams) Recently, we were asked in the R&D forum, how much time Microsoft will take, until they inform you, that you have been granted to access to the protected API’s.Unfortunately, it seems that Microsoft will not inform you per Mail about the successful approvement. In Microsoft Docs, their statement is to use your application to verify if your request has been approved. Microsoft will only write you an email, if they have more questions about the requ

Veeam Backup & Replication 12.3 – A big release with many new functions. Let me show you some of the exciting new possibilities with REST API. And yes, I have also created some scripts 😉Scanning Backups & Veeam Threat HunterVeeam Backup & Replication offers various methods of scanning backups for malware. The Secure Restore feature allows for malware scanning during recovery, preventing the reintroduction of infected files. The Scan Backup functionality will enable you to check backups for malware on-demand. SureBackup provides the possibility to execute this task on a regular or even continuous basis.With the introduction of the Veeam Threat Hunter in Veeam Backup & Replication 12.3, the scanning capabilities become even more powerful. Read the Veeam Backup & Replication v12.3 - What’s new document (page 7) describing the Veeam Threat Hunter capabilities.❗Don’t forget to select the Veeam Threat Hunter in the Malware Detection Settings.Scan Backups using REST APIWi

Hi guys, I was wondering if it is possible to enable the encrypt option for all backup jobs using powershell. I already have created the encryption key/password.  Your help would be appriciated. 

Hi everyone,I wrote some reports that helps me to manage Veeam backups. I put them online to share it to community. Feel free to use them and personnalize them 👍 BR-MorningReport : shows backup results of the night BR-DurationReport : shows duration and layout of backup jobs 

Hi,Where do you guys mostly download Yara rules for Veeam from?This GIT looks not maintained for years (files from 2022).  https://github.com/YARA-Rules/rules/archive/refs/heads/master.zipI also used those links but I had some troubles when scanning backup.https://github.com/Neo23x0/signature-base/archive/refs/heads/master.ziphttps://yaraify.abuse.ch/yarahub/yaraify-rules.zip

hello, Small trick following a bad handling. The objective is to restore on a Windows file server the ACLs of the files without restoring the files.For this we will start by opening the console restore guest files. Once done, click on any file, then explore to find the path to the FLR mount.To get the list of ACLs you can run a single command. This command will save all subfolders and files as a plain text. The text file (acl.txt) will be saved on your current user folder.icacls c:data /save acl.txt /t /cWhere “C:data” is the FLR path, “T” is added to get all subfolders and files on that drive, and “C” allows to ignore all the access errors.If the number of folders and files are too large, then the command will take a long time to complete its execution. At the end of execution, you will get the list of total files which is processed successfully, and the number of files which don’t get success in processing.If you want to restore the lists, execute the following commandIcacls c: /rest

 Hi Community,YARA Scans, one of the exciting new features in V12.1 that I really wanted to start using.YARA is a great tool to help you search and detect malware like ransomware and alert you before it can do any damage.In Veeam Backup and Replication V12.1 you can only select one .yar/.yara file to use for scanning from the "C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules" directory on the Backup Server.After uploading some YARA Rules to my Backup Server, I created an index.yar to include all the individual files/rules so I can run scans using all my YARA rules instead of a single YARA rule.A Yara rule looks like this:Where a Yara index file looks like this:If you select a file with an actual YARA rule the scan works fine, but since the file I selected was my index.yar file, the scan failed!After taking a close look at the YARA-Volume0.log file in (my case in) "C:\ProgramData\Veeam\Backup\FLRSessions\Windows\FLR__vb365.veeam.lab_\Antivirus" on the Mount Server I found

UPDATE (Feb 2024):It was brought to my attention recently that some of the cmdlets have changed in v12.x that may have broken one or more of the above scripts. I’ve rewritten the one that was pointed out (Veeam Agent Jobs) and tested to make sure it works. I can’t vouch for the others, but will try to get around to updating them all (if needed) and posting the updates here. Just be sure if you’re on 12.x or newer that you do thorough checks to confirm it works in a safe environment before attempting to run anything in production.------------------------------------------------------Hello again, everyone! Just sharing another useful PowerShell script to enable/disable Health Checks for multiple jobs. It’s handy whenever you have a large number of jobs which all need to be adjusted and would take a significant amount of time to do so. Usually I wouldn’t share such a short script, but the way to locate and adjust this particular option in a job via PowerShell can be a little confusing if

Greetings, everyone! Today we'll delve into the art of identifying basic file Indicators of Compromise (IoCs), crafting YARA rules to sniff out malicious actors, and seamlessly integrating these rules into Veeam Backup & Replication to safeguard our backups against potential malware threats. But before we dive in, let's take a moment to understand YARA and what its for. YARAYARA is an open-source malware classification tool used to identify and classify malware or suspicious files based on its signatures or rules. It is a powerful and flexible tool that allows users to create rules matching their organization’s needs or targeting specific threats. Moreover, YARA rules are like a piece of programming language, they work by defining a number of variables that contain patterns found in a sample of malware. If some or all of the conditions are met, depending on the rule, then it can be used to successfully identify a piece of malware. Indicators of Compromise (IoCS)Suppose one day a us

Hello Veeam Community! I'm excited to introduce a Python script that I've developed for anonymizing Veeam Backup & Replication logs. Protecting sensitive information in log files is crucial, and this script simplifies the process while maintaining the integrity of your logs. Veeam Log Anonymizer logo Acknowledgments:Before diving into the details, I'd like to express my gratitude:Bertrand: Thank you for the original idea that inspired this script and for your valuable improvement suggestions. Your input was instrumental in making this script more robust and feature-rich. Eric: A big thank you for your unwavering support and encouragement throughout the development process. Your feedback and insights helped shape this tool. Disclaimer:I want to clarify that I'm not a developer by profession, but rather a member of the Veeam community who saw the need for a tool like this. The script has been created out of a passion for data privacy and a desire to contribute to our community.Key Fe

Hi All, I recently migrated some replicated VM’s on our VMWare infrastructure to a new DVSwitch and updated VLAN names, so I had to update all the Veeam replication jobs, when i tried to automate this using the Veeam powershell library I got the following error on 95% of the jobs. I did a little investigation but didnt manage to figure out what the difference was between all the failed jobs and the 3 that successfully updated. Has anyone ever seen this error message before ? Set-VBRViReplicaJob : Broker service has not started hierarchy collection for host xxxxx Here is a simplified version of the script i was using:# get all replication jobs$jobs = Get-VBRJob | Where-Object TypeToString -eq "VMware Replication"foreach ($job in $jobs) { $jobOptions = Get-VBRJobOptions -Job $job # get list of network objects on new target dvswitch $destSwitchNets = Get-VBRViServerNetworkInfo -Server "<server with new dv switch>" | Where-Object SwitchName -eq "NEW SWITCH" # build array

Last year Veeam Backup for Microsoft Office 365 v5 added purpose-built backup and recovery for Microsoft Teams. Since then many customer and partners asked me "How can we protect all of our teams and exclude specific teams objects based on names automatically?".As there is no filter logic within the UI for the Backup Job object exclusion list, I solved this "problem" using the script down below. First we store the credentials (encrypted) in a txt file:$credential = Get-Credential$credential.Password | ConvertFrom-SecureString | Set-Content <path to secure.txt>And here's the script. Just change the values for the following variables: $organizationname Name of the tenant - Only needed if more than one is configured$backupjob            Name of existing the Backup Job$filter                    Name of the team that needs to be excluded. Regular expressions can be used$userName            Username for retrieving the existing Teams in M365$passwordText       Path to the secure.txt fil

Not too long ago I had a customer who only had a Standard license which meant he didn’t have access to SureBackup, but had a need to validate a highly critical SQL database’s backups on a near daily basis. I figured it wouldn’t be too hard to write up a PS script that’d take some basic information about the source job name and database and where it needed to be restored and quickly sort by most recent and selecting it and kicking off the restore. That way he could just fire up the script when necessary. He ended up setting up a scheduled task where each day his DBAs would have the previous day’s backup restored next to the production database and they could do whatever verifications they needed. Easy peasy!Note: Tested and working in v10 & v11 (Should work just fine in v9.x as well, but not tested)<### Un-comment to enable debug output when troubleshooting script ###>#$DebugPreference = "Continue"<### Included for backward compatibility for servers still running pre-v10. #

Hi, We are thrilled to announce the general availability of AsBuiltReport.Veeam.VBR 1.0.0 — a comprehensive PowerShell module that generates professional as-built documentation reports for Veeam Backup & Replication (VBR) infrastructure. What is AsBuiltReport.Veeam.VBR?AsBuiltReport.Veeam.VBR is a specialized report generator that plugs into the AsBuiltReport framework to automatically document your VBR environment. It produces multi-format reports (HTML, Word, Text) that capture the complete state of your backup infrastructure—from backup jobs and repositories to proxies, tape libraries integration, cloud gateways, and more. Key FeaturesReport Sections — Comprehensive coverage of all VBR components including backup repositories, jobs, proxies, WAN accelerators, tape integration, and cloud connectivity Diagram Types — Visual representations of your infrastructure, including backup-to-repository flows, proxy routing, and tape library topology Flexible InfoLevel Configuration — Contr

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v11 is now available on VeeamHub! Here’s a blog post with more detailed information: https://www.arsano.ninja/2021/03/09/veeam-unattended-upgrade-v11/ If you're a VCSP, the script can also be used for Cloud Connect environment upgrades.

Veeam is not responsible nor can be held accountable for the accuracy and usability for code samples published in the Script Library.Scripts are licensed to you by the sample's author and fall under your responsibility.

NewsI would like to share with you a recipe from my "Script Kitchen" that I'm in the process of matching ingredients to. The question I asked myself: Do you really need to protect your Entra ID tenant(s)? My answer: see below ;) IntroEntra ID stores a variety of settings and policies that are important to the continuity of your business. Anything that compromises your Entra ID configuration can result in an immediate loss of access to data and applications. So how about exporting the information to another location so it can be analyzed and imported or reconfigured if something bad happens? And how about adding a retention to the exported data?Microsoft provides some built-in retention mechanisms (Recycle Bin), but these mechanisms are not enough to meet the needs of most organizations. The Recycle Bin stores deleted objects such as users and groups for 30 days. Some limitations which I associate with it:- After 30 days the deleted objects are permanently deleted and cannot be recovere

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12 If you’re familiar with my previously written upgrade scripts for v10 and v11, here’s a summary of enhancements in this latest release:Support for both Windows Server 2019 & 2022 Added support for VBR plugins Veeam Backup for AWS Veeam Backup for Microsoft Azure Veeam Backup for GCP Veeam Backup for Nutanix AHV Veeam Backup for Red Hat Virtualization Veeam Plug-in for Kasten K10 Added support for Veeam Explorer for PostgreSQL Added function to test for pending reboots prior to beginning upgrade Added patch install functionality if Updates folder is present in the Veeam ISO Added check for license as it’s required for VBEM upgrade Added ISO validation as the script was written for v12

Hi Community,after Rick's announcement (thanks for the initiative), I couldn't resist creating another script for the community.As documented, you can add one YARA rule file to the scan process. But what if you want to use multiple YARA rules? Of course you could work with a so-called index file, which refers to the individual YARA rules, but this brings a problem with it, because the YARA rules are stored on the VBR server, but the scan process provides the backups on the mount server and only one YARA rule can be used (This is a topic for another blog post - stay tuned).  What if we would like to use all YARA rules from Rick's Top 10 Ransomware Threats  blog post for a scan? And we don’t want to click so many times in the UI? This Powershell script can help. You can select all YARA rules, only selected YARA rules or all YARA rules if no selection has been made after 30 seconds. The script needs the backup job name and the hostname which has to be scanned. .\vbr-scan-backups.ps1 -Jobn

#region: Add Veeam PSSnapin and ConnectAdd-PSSnapin VeeamPSSnapin$VeeamCred = Get-Credential -Message "Veeam Credential"Connect-VBRServer -Server "192.168.3.100" -Credential $VeeamCredFind-VBRViEntity#endregion#region: VMware Module and vCenter ConnectionGet-Module -ListAvailable -Name VMware* | Import-ModuleSet-PowerCLIConfiguration -DefaultVIServerMode Single -InvalidCertificateAction Ignore -Scope Session -Confirm:$false$vCenterCred = Get-Credential -Message "vCenter Credential"Connect-VIServer -Server "192.168.3.101" -Credential $vCenterCred#endregion#region: List Objects in Backup Jobs$VBRJobs = (Get-VBRJob).where({$_.JobType -eq "Backup" -and $_.Name -like "*Location*"})## List Backup Jobs that match the filter$VBRJobs | Select Name, JobType, SourceType | ft$VBRJobToLocationA = Get-VBRJob -Name "Backup to LocationA"## list Objects in Job$VBRJobToLocationA.GetObjectsInJob().GetObject() | Select ViType, Name, ObjectId | ft#endregion#region: Get Veeam Tag Details## Veeam Inventory(F

SQL Commands for Veeam to be able to link a Backup Job that was done before the Veeam B&R Server was migrated to a new server. and Perform a Backup Copy Job.

A tape verification a day….😉Tape backups are an essential part of data protection strategies as they provide reliable security and offline storage capabilities. However, ensuring the reliability and consistency of tape backups can be critical for regulatory compliance and ensuring data integrity.So I wrote a Powershell script (which has been floating around in my head for a long time) that uses the available Powershell cmdlet "Start-VBRTapeVerification" to regularly check tapes available in a media pool and marks them as checked with time stamps and checks the tapes again after a certain time (default 270 days). It also helps to increase data reliability and reduces the manual effort involved in managing tape backups. The script can be downloaded here.The following parameters can be utilized to customize the tape verification:MediaPool: Specifies the media pool from which tapes will be selected for verification. This parameter is mandatory. NumberofTapes: Determines the number of tape

Hi Everyone, I'm sharing the script to collect the latest Malware Detection logs from specific lists of Veeam Backup servers in their default directory as the attachment with the server name at the end.When there is no new malware detection log file generated on the day, then no email will be sent out.You can update the $Servers and the $ParamSendmailMessage accordingly to suit your needs, as well as the CSS styling.$Servers = 'VBR01', 'BACKUP01', 'BKP-SVR', 'VBRSVR02'$LocalIPAddress = (Resolve-DnsName -Name $ENV:COMPUTERNAME | Where-Object { $_.Type -eq 'A' } | Select-Object -ExpandProperty IPAddress) -join ', '$Filter = '*.LOG'$paramSendMailMessage = @{ From = "$ENV:COMPUTERNAME@$env:userdnsdomain" To = 'your.email@veeam.com' Subject = "Malware report summary as of $(Get-Date -Format 'F')" SmtpServer = 'smtp.domain.com' BodyAsHtml = $true Priority = 'High'}$HtmlHead = @"<style> body { font-family: Calibri; }

Hello community,you  probably know my many scripts on the subject of backup data scanning? I am happy to share with you what I am currently working on.Secure Restore / Scan BackupCurrently "only" Microsoft Windows machines can be scanned using Secure Restore or Scan Backup (see here). However the Disk Publishing (Data Integration API) allows us to publish a disk from different types of backups to a Windows or Linux host. The disk can have a Microsoft Windows, Linux, Unix or other file system. On top Veeam Backup & Replication v12.1 gives us many more options for scanning backup data. For example we now also can mark restore points as clean, suspicious or infected using a PowerShell cmdlet. What if i were to extend one of my scripts with this function? Said and done!New Script - New FeaturesThe new script presents all existing restore points from a Linux VM, Windows VM or Agent backup to a Linux host, scans the specified restore point and marks the selected restore point as infected

Support for Veeam Availability Suite v11 (VBR/EM/ONE) is now available in the Veeam Collection for Ansible! Here’s a blog post outlining changes made and improvements: https://www.arsano.ninja/2021/03/03/veeam-ansible-collection-v11/ For those not familiar with this Ansible collection, please see this blog post for an introduction.