Alert - WIN-INI-PRC-VEEAM-BACKUP-SUSP-CHILD-PROCESS-1

Hello everyone,

Is anyone else getting "High-Risk" detections "WIN-INI-PRC-VEEAM-BACKUP-SUSP-CHILD-PROCESS-1" from Veeam Backup and Replication?

Parent Command Line: "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Service.exe"

Process Owner: SISTEMA

Signer Info: Veeam Software Group GmbH

Sophos Process ID: 20816:133718331003397117

File Path: C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Satellite.exe

Command Line: "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Satellite.exe" "TBKWINBK_server.admin1_PowerShell_TBKWINBK_1507cc51-63c0-4f4e-8622-cc5bc1dc0b66"

This is the first time I have seen this detection. Veeam Backup and Replication has been installed on the server for a long time.

Edit tags
[edited by: GlennSen at 3:20 PM (GMT -7) on 3 Oct 2024]

Top Replies

RB426 1 month ago +1 verified

Support let us know that this was a False Positive and that an update went out yesterday to address it.

0 RB426 1 month ago

Same
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Qoosh 1 month ago in reply to RB426

Hi Rob,

Could you let me know if the details in the detection you're seeing are the same as Gleison mentioned?

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Qoosh 1 month ago

Hi Gleison,

Thanks for reaching out to the Sophos Community Forum.

I have raised an inquiry with our XDR Detections team to look into this. I will update you here once I have more details to share with you.

UPDATE: An update has gone out to reduce the number of false positive detections generated from this rule.

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RB426 1 month ago in reply to Qoosh

It's the exact same, with the difference being the CLI section. Looking at the Veaam Logs under svc.veeambackup.log, this 'Veeam.Backup.Satellite.exe' invokes the PowerShell CLI after each attempt to check for client updates. This had been occurring hourly, which corresponds to our case detections.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
+1 RB426 1 month ago

Support let us know that this was a False Positive and that an update went out yesterday to address it.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel