Veeam Backup & Replication • Re: Malware detection, Ransomware Notice found

Hello Anthony,

the use of a YARA scan to search the "Ransom Note" is locked behind a certain edition of Veeam? I get an error message when trying to scan a backup, mentioning it's not available in your Veeam Data Platform edition.

Yes, in order to use Yara engine you should have a Veeam Data Platform - Advanced edition of the license.

You need to include the file paths in these types of inline scans. I mean if it can produce an alert for the "Ransome Note", log its location.

Right now it's not possible to detect the actual location of the ransomware note because the analysis happens on the block level while the data is in transit, we are researching the possibility to provide this information in the upcoming versions. Thank you!

Statistics: Posted by Dima P. — Dec 21, 2023 7:04 pm

---