curben
/
blog
mirror of https://gitlab.com/curben/blog
1
0
Fork 0
Code Issues Releases Wiki Activity

feat(threat-hunting): "Veeam backup job deleted"

This commit is contained in:
Ming Di Leom 2025-12-02 08:59:47 +00:00
parent 8368e3879b
commit 8376385530
No known key found for this signature in database
GPG Key ID: 32D3E28E96A695E8
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
source/threat-hunting/index.md
View File

@ -2,7 +2,7 @@
title: Splunk Threat Hunting
layout: page
date: 2025-01-15
updated: 2025-11-30
updated: 2025-12-02
---
- [Generate ad_users.csv](ldap-ad-users)
@ -122,6 +122,7 @@ updated: 2025-11-30
- [Unusual printui.exe path](unusual-printui-exe-path)
- [User Login with Local Credentials](user-login-with-local-credentials)
- [VSCode tunnel](vscode-tunnel)
- [Veeam backup job deleted](veeam-backup-delete)
- [Veeam credential extraction](veeam-credential-extraction)
- [Volt Typhoon IOC](volt-typhoon-ioc)
- [Volume Shadow Copy](volume-shadow-copy)

12
source/threat-hunting/veeam-backup-delete.md Normal file
View File

@ -0,0 +1,12 @@
---
title: Veeam backup job deleted
layout: page
date: 2025-12-02
---
References: [1](https://thedfirreport.com/2025/11/17/cats-got-your-files-lynx-ransomware/#impact), [2](https://helpcenter.veeam.com/docs/vbr/events/event_23090.html?ver=13)
SPL:
```spl
index="windows" source="XmlWinEventLog:Veeam-Backup" EventID="23090"
```