Alert - WIN-INI-PRC-VEEAM-BACKUP-SUSP-CHILD-PROCESS-1

Same

Hi Rob, 

Could you let me know if the details in the detection you're seeing are the same as Gleison mentioned? 

Hi Gleison,

Thanks for reaching out to the Sophos Community Forum. 

I have raised an inquiry with our XDR Detections team to look into this. I will update you here once I have more details to share with you. 

UPDATE: An update has gone out to reduce the number of false positive detections generated from this rule. 

It's the exact same, with the difference being the CLI section. Looking at the Veaam Logs under svc.veeambackup.log, this 'Veeam.Backup.Satellite.exe' invokes the PowerShell CLI after each attempt to check for client updates. This had been occurring hourly, which corresponds to our case detections. 

Support let us know that this was a False Positive and that an update went out yesterday to address it.