Unauthenticated RCE in Veeam Service Provider Console: Detection and Remediation Guide for MSPs

---
title: Veeam Service Provider Console Web Process Spawning Shell or Script Interpreter
id: 3f8a2c91-7d54-4b6e-9a21-c5e8f0a1b2c3
status: experimental
description: Detects the VSPC web application process (IIS worker or Veeam service process) spawning command shells, PowerShell, or other LOLBins, consistent with post-exploitation of the unauthenticated RCE chain disclosed by Bishop Fox.
references:
  - https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\Veeam.Manager.Agent.exe'
      - '\Veeam.VSPortal.exe'
      - '\dotnet.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate VSPC management actions do not typically invoke interactive shells from the web worker process. Validate against documented maintenance activity.
level: high
---
title: Executable or Script File Created in Veeam Service Provider Console Web Directories
id: 8b1d4e62-3a97-4f5c-b2d8-9e0a6c3f7d41
status: experimental
description: Detects creation of scripts or executables in VSPC web root and application directories, indicating possible web shell deployment following exploitation of the unauthenticated RCE chain.
references:
  - https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Veeam\Backup and Replication Console\'
      - '\Veeam\Service Provider Console\'
      - '\inetpub\'
      - '\VeeamVAC\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.php'
      - '.jsp'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.hta'
  condition: selection_path and selection_ext
falsepositives:
  - Veeam product updates and hotfix installations. Correlate with patch windows and installer processes (msiexec.exe, Veeam setup binaries).
level: high
---
title: Suspicious Outbound Connection from VSPC Web Application Process
id: c27e5f08-6b43-4d1a-a8f2-3d9c1e5b7046
status: experimental
description: Detects the VSPC web/worker process initiating outbound connections to non-standard destinations, consistent with C2 establishment after unauthenticated code execution.
references:
  - https://bishopfox.com/blog/a-guid-is-not-a-credential-unauthenticated-rce-in-veeam-service-provider-console
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\w3wp.exe'
      - '\Veeam.Manager.Agent.exe'
  filter_known:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '169.254.'
      - '127.'
  condition: selection_image and not filter_known
falsepositives:
  - Cloud repository traffic to object storage endpoints and Veeam update/telemetry servers. Baseline per environment and allowlist documented cloud endpoints.
level: medium

// Hunt: VSPC host web/worker processes spawning shells or LOLBins (potential RCE post-exploitation)
// Scope to your VSPC management servers. Requires MDE or equivalent process telemetry.
let VSPCParents = dynamic(["w3wp.exe", "Veeam.Manager.Agent.exe", "dotnet.exe"]);
let LOLBins = dynamic(["cmd.exe","powershell.exe","pwsh.exe","cscript.exe","wscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","whoami.exe","net.exe","nltest.exe","curl.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (VSPCParents)
| where FileName in~ (LOLBins)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc;
// Corroborate with inbound requests to the VSPC web interface (default TCP 1280) from unusual sources
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort == 1280
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationHostName, RequestURL
| order by RequestCount desc;

-- Hunt VSPC host for web-tier post-exploitation artifacts:
-- 1) recently created scripts/executables under Veeam and IIS directories (potential web shells)
-- 2) web/worker processes with suspicious child commands
LET recent_files <= SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Program Files/Veeam/**/*.aspx',
  'C:/Program Files/Veeam/**/*.ashx',
  'C:/Program Files/Veeam/**/*.ps1',
  'C:/inetpub/**/*.aspx',
  'C:/inetpub/**/*.ashx',
  'C:/inetpub/**/*.exe'
])
WHERE Mtime > now() - 1209600

SELECT FullPath, Size, Mtime FROM recent_files ORDER BY Mtime DESC

SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd\.exe|certutil|bitsadmin|mshta|rundll32|whoami|nltest)'
  AND (Name =~ '(?i)(w3wp|Veeam)' OR CommandLine =~ '(?i)Veeam')

# VSPC exposure verification and hardening script — run elevated on the VSPC management server
# 1) Identify installed VSPC version for patch validation against the current Veeam advisory
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                 HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName -match 'Veeam' } |
    Select-Object DisplayName, DisplayVersion, InstallDate | Format-Table -AutoSize

# 2) Verify the VSPC web interface (default TCP 1280) is NOT exposed to untrusted networks
Get-NetConnectionProfile | Select-Object Name, InterfaceAlias, NetworkCategory
Get-NetFirewallRule -Direction Inbound -Action Allow |
    Where-Object { $_.Enabled -eq 'True' } |
    Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -eq '1280' } | Format-Table

# 3) Restrict the management portal to an administrative allowlist (adjust -RemoteAddress)
New-NetFirewallRule -DisplayName "VSPC Portal - Admin Allowlist Only" `
    -Direction Inbound -Protocol TCP -LocalPort 1280 -Action Allow `
    -RemoteAddress "10.0.10.0/24" -Profile Any
New-NetFirewallRule -DisplayName "VSPC Portal - Block All Else" `
    -Direction Inbound -Protocol TCP -LocalPort 1280 -Action Block -Profile Any

# 4) Audit for suspicious child processes of the web/worker process in the last 14 days
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'w3wp.exe|Veeam.Manager.Agent.exe' -and
                   $_.Message -match 'cmd.exe|powershell.exe|mshta.exe|certutil.exe|rundll32.exe' } |
    Select-Object TimeCreated, Message | Format-List