VOBProtectCD

Hunt Hypothesis

This rule detects the presence of VOBProtectCD, a component of the Veeam backup agent, which adversaries may deploy to establish persistence or facilitate data exfiltration through backup infrastructure. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify unauthorized backup agents or compromised endpoints that could be leveraged for ransomware attacks or long-term stealthy access.

YARA Rule

rule VOBProtectCD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5F 81 EF [4] BE [2] 40 ?? 8B 87 [4] 03 C6 57 56 8C A7 [4] FF 10 89 87 [4] 5E 5F }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A system administrator manually installs or updates the Veeam Backup & Replication console on a management server, triggering the installation of the VOBProtectCD (Veeam One Backup Protection Client) agent.
  • Filter/Exclusion: Exclude processes where the parent executable is msiexec.exe or setup.exe and the image path contains \Veeam\Backup and Replication\ or \Veeam\One\.
• Scenario: The Veeam Backup Service performs a scheduled maintenance task or agent health check, causing the vobprotectcd.exe service to restart or re-initialize its communication channel with the backup server.
  • Filter/Exclusion: Exclude events where the process name is vobprotectcd.exe and the parent process is services.exe or svchost.exe (specifically the Veeam service host), provided the user context is SYSTEM or VeeamBackupService.
• Scenario: An enterprise endpoint protection suite (e.g., CrowdStrike Falcon, Carbon Black) performs a real-time scan or remediation action on the Veeam agent binaries, causing a temporary file copy or process spawn that matches the YARA signature.
  • Filter/Exclusion: Exclude detections where the parent process belongs to known EDR/AV tools (e.g., FalconSensor.exe, CbEngine.exe, MsMpEng.exe) and the file path resides in the Veeam installation directory (e.g., C:\Program Files\Veeam\).
• Scenario: A PowerShell script used for automated Veeam agent deployment or configuration (e.g., Install-VeeamAgent.ps1) executes the agent installer or modifies the agent configuration, triggering the YARA rule on the associated executable or DLL.
  • **Filter/Ex