• EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 153 Topics
  • 751 Comments

153 Topics

Chris.Childerhose
Chris.ChilderhoseVeeam Legend, Veeam Vanguard
posted in YARA and Script Library

Veeam Service Providers - Check Ransomguard

This is a simple oneliner for the MSPs out there if you are needing to check if Ransomguard is enabled for your VCC tenants this will output it on the screen for you from Powershell - Get-VBRCloudTenant  | sort-object | FT Name, BackupProtectionEnabled, BackupProtectionPeriod You can also output this to a file that could be emailed as well.

4
Chris.Childerhose
3 years ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library

Enforce Backup Job Basic Retention

Here’s a sample PowerShell script to enforce Restore Point configuration for both VMware Backup Jobs & vCloud Backup Jobs. The script retrieves the job’s current retention setting (Restore Points), compares it against the standard defined in a CSV file, and adjusts the configuration where needed. For more detailed information, please follow the VeeamHub link:https://github.com/VeeamHub/powershell/tree/master/BR-EnforceJobRetention

7
marcofabbri
2 years ago
CptAmerica
CptAmericaComes here often
posted in YARA and Script Library

Restore Same Folder/Files From Multiple Backups

First time sharing, so feedback is much appreciated, but please excuse my code if it’s not up to par with those who have a lot more experience with Powershell than I. I recently had a client who -- for legal purposes -- needed to restore the same folder from two month’s worth of backups. Running 61 File Level Restores in the GUI seemed like a nightmare, so he opened a case asking if there was an easier way. Unfortunately, through the GUI there’s really not an easier way, but this sounded like a perfect scenario for leveraging some Veeam PowerShell cmdlets. I soon discovered that the FLR cmdlets don’t have functionality that supports a ‘Copy To’ feature like you’d get in the GUI, so I had to leverage what Veeam cmdlets we do have and then add in some good old basic PowerShell commands to then pull the data from the mount point (C:\VeeamFLR\ by default) and move it to the target, then loop through n-number of times based on the user input.Here’s what I came up with. I’m still working on

2
CptAmerica
3 years ago
BertrandFR
BertrandFRInfluencer
posted in YARA and Script Library

script for an immutable configuration backup on linux

Hello,I could say better late than never, i’m using a script since many years to make my configuration configuration immutable on a linux repos.Even it is now available for object storage and it will probably be immutable in future release, i think it could useful to share it. #!/bin/bash# Define a list of target directoriestarget_directories=("/path/to/your/target_directory1" "/path/to/your/target_directory2")attribute_to_apply=" +i" # The chattr attribute to apply (e.g., immutable)time_to_wait_days=10 # Time to wait in days before removing chattr attributelog_path="/path/to/your/logfile.log" # Replace with your desired log path# Calculate the time to wait in secondstime_to_wait_seconds=$((time_to_wait_days * 24 * 60 * 60))# Log the start timeecho "$(date): Chattr attribute application started for files in ${target_directories[*]}" >> $log_path# Loop through all target directoriesfor target_directory in "${target_directories[@]}"; do # Loop through all files in the target dir

3
Chris.Childerhose
3 months ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library

VeeamONE - Suspicious Increment Size - Remediation Action Script

IntroYou know the stories: Sometimes an incorrect keyboard layout can lead to incorrect entries. Or while coding, , you must make sure that you use the correct special characters such as ' or ", etc.  But let's focus on the main topic - Veeam ONE AlertsVeeam ONE Alert - Suspicious incremental backup sizeYou probably know this Veeam ONE Alert: Veeam ONE Alert - Suspicious incremental backup size. What many may not know is that you can configure Veeam ONE to perform remediation actions when alerts are triggered. These actions can be performed automatically or after manual approval.Veeam ONE offers the following types of remediation for alarms:Predefined actions that are configured for the most commonly used out-of-the-box alarms.  Custom scripts that you can specify in the settings of any alarm. For each severity level, Veeam ONE can run one or more custom scripts.For the Suspicious incremental backup size alert we do have a predefined action available: Predefined RemediationA SureBackup

1
Chris.Childerhose
11 months ago
B
BystanderNew Here
asked in YARA and Script Library

Set a file list for backup in before job script

Hi,I need to write to the tape files created during previous day. I have a script which generates that list. How can I tell Veeam, which files to write?Do I need to write script creating a new job each day or it is possible to use “before job script” for that?Thanks in advance 

10
Rick Vanover
1 year ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library

Veeam Collection for Ansible: v12.1 support

Support for the v12.1 (VBR/EM) is now available in the Veeam Collection for Ansible!Veeam Backup & Replication 12.1 is an incredible release jam-packed with goodies! Among those is a brand new process for installing & upgrading Veeam Backup & Replication, Veeam Backup Enterprise Manager, and the Veeam Backup & Replication Console.I’m happy to report this collection fully supports this process! Please review the below changelog for more detailed changes in this release: Breaking ChangesChanged default ISO checksum algorithm from SHA256 to SHA1 As Veeam’s website doesn’t provide SHA256 checksum, this only made sense to change. Major ChangesAdded support for new silent install process available in version 12.1 Added support for new silent install process available in version 12.1 Added support for Veeam Backup & Replication Console 12.1 install Added support for Veeam Backup & Replication Console 12.1 upgradeMinor ChangesUpdated ISO to version 12.1 Updated logic fo

7
leduardoserrano
2 months ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library

Veeam Usage Report for VMware Cloud Director

Deprecated: This script will not work with Veeam Backup & Replication v12. For v12 support, please use the VSPC-HostedUsage scripts. The PowerShell script to retrieve Veeam backup usage for VMware Cloud Director (VCD) Organizations is now available on VeeamHub! Below is a brief description of its functionality. For more detailed information, please follow the VeeamHub link.For each organization, the following is provided:Total number of VMs in backups Total amount of space used in repositoriesThe usage data can be aggregated on the Organization-level or the Org VDC-level. This is useful when backups for different Org VDCs are billed differently.The scope of the usage returned is also customizable. It can be limited to self-service backups, created by the Veeam Self-Service Portal (VSSP) for VCD, or it can also include backups created directly on the backup server by the provider.NOTE: Before using this script in a production environment, I recommend you verify that numbers match up

1
Chris.Childerhose
3 years ago
K
KirmisNot a newbie anymore
asked in YARA and Script Library

Veeam 365 | SharePoint personal sites ?

Hello Veeam,In Veeam 365 backup for SharePoint online, I see that can backup the SP online sites and also has a category for “Personal Sites”.Can anyone explain what is these Personal Sites and where can I find them in SharePoint admin portal?I couldn't found any explanation even in Veeam documentation about Personal Sites.https://helpcenter.veeam.com/docs/vbo365/guide/back_up_sites.html?zoom_highlight=personal+sites&ver=60 Thank you in advance,Nikos 

3
K
1 year ago
StefanZi
StefanZiComes here often
posted in YARA and Script Library

Advanced Linux File Level Restore including Cross Restore

What? Mount the contents of the latest restore point of a Linux VM to the very same or another VM using the data integration API. Why? Linux admins can just browse the backup contents on the local system and restore the files they need (on the CLI 😉) Advanced & complex restore scenarios Cross-restore to another server (source server and target server can be different) $machine = "esxrhel1"$machine_dns = "esxrhel1.lab.local"$machine_credentials = Get-VBRCredentials -Name "veeam" | ? { $_.Description.Contains("Veeam Linux Account") }$rp = Get-VBRRestorePoint -Name $machine | Sort-Object -Property CreationTime | select -Last 1$publishSession = Publish-VBRBackupContent -RestorePoint $rp -TargetServerName $machine_dns -TargetServerCredentials $machine_credentials -EnableFUSEProtocol -Reason "Test FUSE restore"# Print info on session$publishSession#Unpublish-VBRBackupContent -Session $publishSessionAs a result on the Linux system you’ll get loop mounts like these./dev/loop0 on /tmp/Veea

2
E
11 months ago
Scott
ScottVeeam Legend
posted in YARA and Script Library

Time based groups for Active Directory

If you have Veeam on your domain, or Enterprise Manager and want to give a user access for a specific amount of time, you can achieve this with a simple PowerShell command.  Add-ADGroupMember -Identity ‘Group_NAME’ -Members ‘Username’ -MemberTimeToLive (New-TimeSpan -Minutes *****) The issue with this is trying to calculate minutes to days, weeks, months, or having some sort of searchable way to do this task.  Onboarding users with this method was proving difficult so I thought of easier ways to achieve this.  What started off with an overly complex excel spreadsheet to extract minutes from dates and generate a command has now become an PowerShell based GUI.  In the below script. anything with “*****” should be replaced with items from your own AD infrastructure. This allows to search 1 or many users and add them to 1 or many groups. If you select the TTL checkbox, you can select the end date when the users will be removed from the groups. The user and group names can be searched start

6
Scott
1 year ago
vAdmin
vAdminInfluencer
posted in YARA and Script Library

Get the most recent malware detection logs from each Veeam Server and send over email with summary

Hi Everyone, I'm sharing the script to collect the latest Malware Detection logs from specific lists of Veeam Backup servers in their default directory as the attachment with the server name at the end.When there is no new malware detection log file generated on the day, then no email will be sent out.You can update the $Servers and the $ParamSendmailMessage accordingly to suit your needs, as well as the CSS styling.$Servers = 'VBR01', 'BACKUP01', 'BKP-SVR', 'VBRSVR02'$LocalIPAddress = (Resolve-DnsName -Name $ENV:COMPUTERNAME | Where-Object { $_.Type -eq 'A' } | Select-Object -ExpandProperty IPAddress) -join ', '$Filter = '*.LOG'$paramSendMailMessage = @{ From = "$ENV:COMPUTERNAME@$env:userdnsdomain" To = 'your.email@veeam.com' Subject = "Malware report summary as of $(Get-Date -Format 'F')" SmtpServer = 'smtp.domain.com' BodyAsHtml = $true Priority = 'High'}$HtmlHead = @"<style> body { font-family: Calibri; }

6
coolsport00
2 months ago
S
skbro27New Here
asked in YARA and Script Library

Monthly Veaam Backup report - html

Looking for backup report script to output to html. Currently not veaam one in the environment. 

2
coolsport00
3 months ago
jdw
jdwComes here often
posted in YARA and Script Library

Enable Snapshot-Only Jobs for Secondary Storage Array for Pure Storage FlashArray with This Post-Job Script

VBR integration for storage systems supports several useful features that optimize backup performance. Unfortunately for those systems built on the Universal Storage API (USAPI) some of those features are not yet available. One specific feature that is missing is the ability to orchestrate array-based snapshots on a secondary storage array.I’ve written a PowerShell script to be used as a post-job VBR script along with snapshot-only jobs for Pure Storage FlashArray which will replicate Veeam created array snapshots to a secondary FlashArray. It will also ensure that those snapshots are visible in the VBR console and available for recovery tasks including Instant VM recovery, Guest Files recovery, and Application Item Recovery. Download Invoke-PfaSendSnapAfterVBRJob.ps1 from GitHub. Detailed setup instructions. This script has been designed to work both with VBR v10 VeeamPSSnapIn as well as the brand new VBR v11 PowerShell Toolkit.  

1
JMeixner
3 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library

Powershell - VBO Exchange Mailbox Item Restore Content Checker

During my presentations on VBO to customers and partners, people sometimes ask whether the recoverability of data can be checked automatically (Our Veeam Backup & Replication customers love SureBackup). However, this functionality is not available.Since I have now been told this "wish" several times, I thought "New Year, New Luck!"First, I share the Powershell script to check backed up Exchange Online restore data. With this script it is possible to save an email from a mailbox to a local directory and check if a certain pattern can be read.More functions will be added soon. Please give me feedback what can be improved or added.A script for checking OneDrive for Business data will also be available soon. The script can be found here:https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-exrestore-checker And don't forget: Always post feature requests in our R&D forum!

4
regnor
2 years ago
StefanZi
StefanZiComes here often
posted in YARA and Script Library

VB365-JobManager - Script to create and maintain SPO & Teams jobs

Guys, I've created a script to automatically create SPO and Teams jobs. Main features includeCreate jobs for all currently unprotected SPO sites and teams Build jobs based on a object-limit per job (incl. recurse option to cope with SP subsites) Distribute jobs over different repositories automatically (which includes proxy balancing of course) Add matching teams to the same job as the SP site as per BP Automatic scheduling with delays per job (configurable) All built on the VB365 API - so no M365 application or so required Include & excludes possible Can put objects in a job pointing to a repository which already contains backups of this objectThe script is available on VeeamHub: powershell/VB365-JobManager at master · VeeamHub/powershell (github.com) I already have two larger customers using versions of this script and am looking for more feedback of course.

2
Chris.Childerhose
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library

Powershell - Restore VBR Configuration Database - V12.1

With Veeam Backup & Replication (VBR) 12.1 it is possible to restore the Configuration Database using Powershell. Basically a simple task, if there weren't a few things to consider. Challenge accepted!My SetupLet's prepare for the scenario where the primary VBR is no longer available and the configuration database needs to be restored on another system with a different hostname (standby VBR). On the primary VBR, the configuration backup was encrypted according to the best practices and MFA was also activated for part of the users. The configuration database runs on PostgreSQL.I had the following thoughts before creating the scriptCheck that only the necessary Veeam services are running on the standby VBR server Check if the response file has the proper entries (e. g. not automatically starting the Veeam services after the restore) When MFA is enabled/used, updates must currently be made to the database after restoring the configuration DB (see here) The encryption password should n

3
Chris.Childerhose
5 months ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library

Veeam Backup & Replication - File Level Restore - Hash Scanner

Hello community,the Backup Scanning Tools Web Console got a new buddy:  📃🔎 File Level Restore - Hash Scanner 📃🔎 This Powershell script scans specific subfolders within a Veeam File Level Recovery session and checks if any of the scanned files match a SHA256 value by comparing the values to a list of known hash values. Common locations for temporary Internet files in Windows systems are scanned. The list can be supplemented at any time.The following subdirectories in the Users folder are scannedDownloads AppData\Local\Temp AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data AppData\Local\Google\Chrome\User Data\Default\Cache AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupThe script has been integrated into the Backup Scanning Tools Web Console, but can also be run manually. On top you'll also get this script:vbr-flr-auto-hashscanner.ps1This script automates the execution of the scans Windows VM included in a specific backup job. The number of VMs to be scan

3
Scott
8 months ago
I
InfowhizNew Here
asked in YARA and Script Library

Backup Eamil Notifications

Is that any way to trigger notification when backup job start?

6
D
1 year ago
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library

Get-VeeamDistroSvc.ps1

#Requires -Version 5.1 -PSEdition Desktop<#.SynopsisReports on a given list of AD servers if they have the VeeamDistributionSvc running and it's startType. This is in response to Veeam KB4288, https://www.veeam.com/kb4288.NotesVersion: 1.0Author: Jim Jones, @k00laidITModified Date: 3/13/2022.EXAMPLE.\Get-VeeamDistroSvc.ps1#>$svcName = "VeeamDistributionSvc"$servers = Get-ADComputer -filter * | where {$_.Name -like "*veeam*" -or $_.Name -like "*backup*" -or $_.Name -like "*whatever*"}[System.Collections.ArrayList]$mySvcInfo = @()foreach ($server in $servers) { $svcstatus = get-service -ComputerName $server.name -Name $svcName | select name, status, startType $quickInfo = New-Object psobject -Property @{ server = $server.name service = $svcstatus.Name status = $svcstatus.status startType = $svcstatus.startType } $mySvcInfo += $quickInfo}$mySvcInfo | select server, service, status, startType 

2
regnor
2 years ago
Scott
ScottVeeam Legend
posted in YARA and Script Library

List of Tapes and load count

I have a lot of tapes and multiple libraries. I recently had a few failures, and wanted to check how many times each tape has been loaded and either read or written too to see if there is a trend with the oldest ones.  I created a little script to do this, and figured I’d sort it from the most loads at the top.    It ended up being a coincidence and I have plenty of life left in all my tapes, but always fun to lean a new command # Load Veeam PowerShell SnapIn if not already loadedif ((Get-PSSnapin -Name VeeamPSSnapIn -ErrorAction SilentlyContinue) -eq $null) { Add-PSSnapin VeeamPSSnapIn}# Get all tape media$tapes = Get-VBRTapeMedium# Create an array to hold the results$results = @()foreach ($tape in $tapes) { $tapeInfo = "" | Select-Object 'TapeName', 'LoadCount' $tapeInfo.TapeName = $tape.Name $tapeInfo.LoadCount = $tape.LoadCount $results += $tapeInfo}$results | Sort-Object LoadCount -Descending | Format-Table 

3
jos.maliepaard
10 months ago
andy.sturniolo
andy.sturnioloComes here often
posted in YARA and Script Library

Unveiling Cyber Threats: Harnessing YARA and Veeam for Malware Detection! - Part 2

Hello everyone. Last time we explored how to identify basic file Indicators of Compromise (IoCs), develop YARA rules to detect malicious actors, and incorporate these rules into Veeam Backup & Replication to identify potential malware in our backups.Taking it a step further, today we will explore how to automatically generate YARA rules using YarGen. YarGenYarGen is a tool that generates YARA rules from a specified malware file. It identifies unique strings within the malware and excludes those prevalent in non-malicious files. This is achieved using YarGen's comprehensive database of strings and opcodes typically found in non-malicious files. Essentially, it creates YARA rules from strings in malware files while discarding those also present in goodware files.There are many variable and options that can be set in YarGen, today we are going to look at how it can create a YARA rule based off of a potential malware file. Back to basics - IoCSA user has noticed a folder called “freest

5
Iams3le
2 months ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library

Powershell - VBR 12.1 - Guest Index Data Scan Manager

IntroFirst of all: Happy new year to everyone!With Veeam Backup & Replication 12.1, many new security features have been added. One of these is the Guest Index Data Scan. For this, Veeam Backup & Replication uses a signature-based approach. During/after the backup job, the following malware activity can be detected:- Malware signatures specified in the "C:\Program Files\Veeam\Backup and Replication\Backup\SuspiciousFiles.xml" on the backup server- Multiple files renamed by malware- Multiple files deleted by malwarePlease read the Help Center documentation  to learn more about the details and how it works.In addition to the XML file, manual customization is also possible. You can add a malware signature that is marked as suspicious (Suspicious files) or that should be skipped (Trusted files) during the scan. See here. Questions you might askBut how do you know how many "built-in" and how many manually entered entries there are? Of course you can check the manual settings in the

5
vAdmin
1 month ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library

VSPC Sample Usage Report

One of the first scripts I wrote after I joined Veeam was one that produced a license usage report using the Veeam Availability Console API. Since then, a lot has changed! The product was rebranded to Veeam Service Provider Console (VSPC) and it’s API was greatly updated in a complete rewrite!That change occurred a couple years ago... As such, it was definitely long overdue for this script to be reworked so it could leverage this amazing new API! This script uses minimal API calls to retrieve current point in time license usage for every company in VSPC. On top of that, if the company is managed by a reseller, reseller information will be included in the output.Developer’s notes...This script is meant to be a stepping stone as the framework can easily be used in other automations. I tried to keep most of the code modular by design so folks can use the script as-is or take the pieces you need for your custom Veeam integration. It can also serve as a reference on how to use Asynchronous

2
victorwu
1 year ago
StefanZi
StefanZiComes here often
posted in YARA and Script Library

Create least privilege VBO Azure AD applications without using VBO

Here’s a script I wrote to create Azure AD applications for VBO usage aside from creating the app from within VBO itself.I experienced that this is not always easy to do (Global Admin using VBO to create an app, or having the Global Admin read the documentation and create the application with the right permissions, etc… on his own), so I hope my script can help here. Check out my blog article on it at VBO365: Create Azure AD applications automatically with least priviliges – Z8NAnd the script itself is available on Github: veeam/vbo-create-azure-ad-app.ps1 at master · StefanZi/veeam (github.com)

4
gulzarshaikhveeam
3 years ago

Badge winners

Show all badges
Terms & Conditions