CVE-2026-106077

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName == "Veeam.Backup.M365.Service.exe" // Or other relevant Veeam process
| where ProcessCommandLine contains "read" and ProcessCommandLine contains "file" // Refine based on actual attack pattern
| where AccountName endswith "Administrator" // Or specific Veeam admin accounts
| where ProcessIntegrityLevel == "System" // Indicates LocalSystem privileges
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName, ProcessIntegrityLevel

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 NewProcessName="*Veeam.Backup.M365.Service.exe*" CommandLine="*read*file*" | search User_Name="*Administrator" | search TokenElevationType="%%1936" // Or other indicator for LocalSystem
| table _time, host, NewProcessName, CommandLine, User_Name, TokenElevationType

Sigma

title: Veeam Backup for Microsoft 365 Arbitrary File Read
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects attempts by a Veeam Backup for Microsoft 365 Administrator to read arbitrary files with LocalSystem privileges.
author: SecBoard
date: 2026/10/28
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\Veeam.Backup.M365.Service.exe'
    CommandLine|contains: 
      - 'read'
      - 'file'
    User|endswith: 'Administrator'
    IntegrityLevel: 'System'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
  - User
  - Image
tags:
  - attack.t1003.001 # OS Credential Dumping: LSASS Memory
  - cve.2026.106077
  - exploitation
  - privilege_escalation

Elastic ES|QL

from process where process.executable.path : "*Veeam.Backup.M365.Service.exe" and process.command_line : "*read*file*" and user.name : "*Administrator" and process.integrity_level : "System" | project @timestamp, host.name, process.executable.path, process.command_line, user.name, process.integrity_level