Alert - WIN-INI-PRC-VEEAM-BACKUP-SUSP-CHILD-PROCESS-1

Hello everyone,

Is anyone else getting "High-Risk" detections "WIN-INI-PRC-VEEAM-BACKUP-SUSP-CHILD-PROCESS-1" from Veeam Backup and Replication?

Parent Command Line: "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Service.exe"

Process Owner: SISTEMA

Signer Info: Veeam Software Group GmbH

Sophos Process ID: 20816:133718331003397117

File Path: C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Satellite.exe

Command Line: "C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Satellite.exe" "TBKWINBK_server.admin1_PowerShell_TBKWINBK_1507cc51-63c0-4f4e-8622-cc5bc1dc0b66"

This is the first time I have seen this detection. Veeam Backup and Replication has been installed on the server for a long time.

Parents

0 RB426 12 hours ago

Same
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Qoosh 10 hours ago in reply to RB426

Hi Rob,

Could you let me know if the details in the detection you're seeing are the same as Gleison mentioned?

Kushal Lakhan

Team Lead, Global Community Support
Connect with Sophos Support, get alerted, and be informed.
If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RB426 9 hours ago in reply to Qoosh

It's the exact same, with the difference being the CLI section. Looking at the Veaam Logs under svc.veeambackup.log, this 'Veeam.Backup.Satellite.exe' invokes the PowerShell CLI after each attempt to check for client updates. This had been occurring hourly, which corresponds to our case detections.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 RB426 9 hours ago in reply to Qoosh

It's the exact same, with the difference being the CLI section. Looking at the Veaam Logs under svc.veeambackup.log, this 'Veeam.Backup.Satellite.exe' invokes the PowerShell CLI after each attempt to check for client updates. This had been occurring hourly, which corresponds to our case detections.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data