VeeamON 2025 San Diego, California
Download featured YARA rules, browse code samples or contribute your own scripts
Recently active
We’ve updated the Script Library section to include YARA rules. I’ve made a quick video (sorry for the cheesy graphics...) on how to install a YARA rule from this site and perform your first scan!
Welcome to the YARA and Script Library! This area of the community hub will provide community driven scripts and YARA rules, with selected featured items. Veeam Data Platform 23H2 includes Veeam Backup & Replication v12.1 which includes YARA Scanning. This area of the Veeam Community Hub will offer featured YARA rules for use. Custom script troubleshooting is not supported. What's in Scope:Confirming that Veeam Backup & Replication recognized the YARA rule file.What's Out of Scope:Troubleshooting why a custom YARA rule did not function as intended.This area also includes scripts in the Script Library. Generally speaking, scripts are licensed to you by the sample's author and fall under your responsibility and is governed by the Veeam Customer Support Policy. The figure below summarizes the scripting support for PowerShell:Excerpt from KB2183: PowerShell Script Execution Troubleshooting Advice (veeam.com)
If you do not run VeeamONE, it can be challenging to check if every VM that should be backed up, is really backed up. Therefore I wrote a small PowerShell script. Basically this script looks for each VM if there is a restore point for this VM. If not, it gets listed. Extra feature: Script connects to every vCenter that is registered in B&R server. There is a Blocklist included: when VMs should not be backuped, just place their name in the blocklist and they will not be shown in the list. So you can exclude VMs without editing the script.Notes:CredObject.xml is used for stored, encrypted credentials. Script connects to local B&R server, so it should run there if not changed. # Load Plugin and moduleAdd-PSSnapin VeeamPSSnapinImport-Module VMware.VimAutomation.Core# Configure for multiple vCenter ConnectionsSet-PowerCLIConfiguration -DefaultVIServerMode Multiple -Scope Session -Confirm:$falseSet-PowerCLIConfiguration -InvalidCertificateAction Ignore -Scope Session -Confirm:$false#
Recently I had to troubleshoot a Veeam Backup & Replication (B&R) problem. There the question popped up which are the running Veeam jobs at point or period of time. The GUI is not a big help to answer this question. Therefore I wrote a small script that show these jobs.The following PowerShell script snippet is quite simple. First, start- (tStart) and end-date/time (tEnd) are asked for input. The following query selects all running Veeam jobs at point or period of time that matches input dates.# Ask for start- and end-date and timeWrite-Host "Enter date in format " ($(get-date).ToString("dd.MM.yyyy HH:mm"))$tStart = Read-Host "Enter start-time (Enter for now)"$tEnd = Read-Host "Enter end-time (Enter for equal to start-time)"if ($tStart -eq '') {$tStart = get-date -Format "dd.MM.yyyy HH:mm"}if ($tEnd -eq '') {$tEnd = $tStart}# Check input datatry {$tStart = [DateTime]::Parse($tStart)}catch {Write-Host "start-time wrong input"; continue}try {$tEnd = [DateTime]::Parse($tEnd)}cat
Hello, we are monitoring the customer backups via PRTG.Till now, we had a SQL Skript, wich got the latest result and reported it to PRTG:SELECT latest_result FROM bjobs WHERE name = @prtg;That worked fine with MSSQL Express, but now with PostgreSQL we have to use a PostgreSQL Sensor in PRTG. Thats no problem, but it always failes with: “GSS/SSPI authentication but IntegratedSecurity not enabled” when I try to use the postgres user, or with: 28000: SSPI-Authentication for user Administrator failed”. For debugging I tried to change the access settings in the pg_hba.conf file but nothing seems to work.Is there a way I can still run queries to the config database? Or do I have to go via the PowerShell Snappin from Veeam?PS: We don’t use the Enterprise Manager, because you need the Enterprise Plus license for that and our customers don’t have that license. Thanks alot.
Since the introduction of NAS backup capability with v10 of Veeam Backup & Replication there have been many requests for tape support. But as we all know, Veeam’s NAS backup doesn’t support tape (yet?), neither as a primary nor as secondary (backup copy or archive) target.With v11 we got the new feature called “instant file share recovery” which lets us publish file shares directly from the backups previously created with NAS backup jobs. My colleague Uwe Groening recently came up with the idea to use these shares, published by instant file share recovery, as a source for file to tape jobs within Veeam. This way, it should be possible to create tape copies directly from existing file share backups. This makes a huge difference to other solutions that involve either reading data from the production share again or staging a restore on some (extra) storage prior to using “file to tape” from there.We discussed this idea in more detail and created a process (for a single NAS backup job)
This script showcases just how easy it is to use Veeam PowerShell cmdlets to export an M365 mailbox. This script is designed to be executed on a Veeam Backup for Microsoft 365 (VB365) v6 server and it's interactive so no parameters are required. Upon execution, the script polls for information which culminates in the specified user mailbox being exported to a PST file.The code in this script could also be referenced to create a script to fully automate the mailbox export process.For more detailed information, please follow the VeeamHub link:https://github.com/VeeamHub/powershell/tree/master/VB365-ExportMailboxToPSTHere’s a screenshot of what it looks like in action:
Doc Veeam validatorKB2086: How to Use the Veeam Backup ValidatorVeeam Backup Validator - Veeam Backup Guide for vSphere It is essential to verify the status of the backups at the CRC level on the storage and the possibility of restoring them via Surebackup.During the wizard for creating a backup job you can enable "Storage backup files healt check (detect and auto-heals corruption. https://helpcenter.veeam.com/docs/backup/vsphere/backup_health_check.html?ver=110I prefer to automate the validation process to have a detailed report every 2 weeksCopy past and save .ps1 format <#.SYNOPSIS Performs a validation of all server backups.DESCRIPTION .NOTES File Name : veeam_validator.ps1 Author : Me and my colleague Prerequisite : PowerShell V2 , VeeamPSSnapIn installed#>#------------------------------------------ VARIABLES TO CHANGE -------------------------$email_infoTO = "yourmail@yourdomain.com"$email_infoFrom = "$($env:COMPUTERNAME)@ yourdomain.com "$email_
Now that V12.1 is available, I wanted to share with you a featured YARA rule set that can give you on-demand scanning for some top ransomware threats. Attached to this post is a file named: Top10RW_YARArules.zip. In this file are YARA rules for some common ransomware threats that have been seen recently:Attribution: This great collection was made by Felix Bilsten. Links: X: Felix Bilstein (@fxb_b) / X (twitter.com), website: Felix Bilstein - project overview (cocacoding.com) and Github: fxb-cocacoding (Felix Bilstein) · GitHub
Support for the newly released v12 (VBR/EM/ONE) is now available in the Veeam Collection for Ansible!What enhancements can you expect?Support for Windows Server 2022 Full support for PostgreSQL when performing VBR/EM installs Including local & remote DBs A new module to apply PostgreSQL performance tuning Leverages the Set-VBRPSQLDatabaseServerLimits PowerShell cmdlet Automatic enabling of the PostgreSQL pg_stat_statements extension during PostgreSQL installation This assists in performance troubleshooting Additional sample v12-specific playbooks Upgraded dependencies leveraging the latest ansible collections for Windows: ansible.windows: 1.13.0 community.windows: 1.12.0 For those not familiar with this Ansible collection, please see this blog post for an introduction.
One thing I’ve found as a Veeam customer is you often have to restart the VSS services on your SQL and other VSS aware servers. Here’s a script I wrote to do just that.# Name: Restart-VSS.ps1# Description: Restarts list of services in an array on VMs with a given vSphere tag. Helpful for Veeam B&R processing# For more info on Veeam VSS services that may cause failure see https://www.veeam.com/kb2041Import-Module VMware.PowerCLI$vcenter = "vcenter.domain.com"$services = @("SQLWriter","VSS")$tag = "myAwesomeTag"Connect-VIServer $vcenter$vms = Get-VM |where {$_.Tag -ne $tag}ForEach ($vm in $vms){ ForEach ($service in $services){ If (Get-Service -ComputerName $vm -Name $service -ErrorAction SilentlyContinue) { Write-Host $service "on computer" $vm "restarting now." Restart-Service -InputObject $(Get-Service -Computer $vm -Name $service); } }}
[CmdletBinding()]param ( # CSv file tab delimited with name and Vlan [Parameter(Mandatory = $true)] [string[]] $CSV, # The datacenter where you want to move the workload to. [Parameter(Mandatory = $true)] [string] $Datacenter, # The Cluster where you want to move the workload to. [Parameter(Mandatory = $true)] [string] $Cluster, # Errorlog [Parameter()] [string] $ErrorLog = 'E:\Scripts\ErrorLog.txt', # Enable error logging [Parameter()] [switch] $LogErrors, # Enable error logging [Parameter()] [Int32] $HostIndex = 0)#$Global:ErrorLog = 'E:\Scripts\ErrorLog.txt'function Write-ToLog { [cmdletbinding()] Param ( [string] [parameter(ValueFromPipeline)] $Text ) if ($LogErrors) { $timestamp = Get-Date Write-Output "$timestamp :: $Text" | Tee-Object $ErrorLog -Append }}function Move-Workload { <# .SYNOPSIS Performs a migration of VMs running on Hyper-V to
