File Detection

In the File Detection tab, you can enable and configure file system activity analysis, manage the list of suspicious files and extensions, and choose which indicators of compromise to monitor. In the Veeam Backup & Replication web UI, the same settings are available under File system activity analysis and Indicators of compromise detection.

To enable file system activity analysis, do the following:

1. From the main menu, select Malware Detection.
2. In the File Detection tab, select the File system activity analysis check box. This option enables the scan for known suspicious files and extensions, multiple deleted files, and multiple extension changes. For more information, see the following sections:

• Known Suspicious Files and Extensions
• Multiple Deleted Files
• Multiple Extension Changes

3. For machines, make sure that you enable guest file system indexing for the required backup job. For more information, see the following sections related to specific platforms:

• VMware vSphere — Specify Guest Processing Settings
• Microsoft Hyper-V — Specify Guest Processing Settings
• Veeam Agent for Windows — Specify Guest Processing Settings
• Veeam Agent for Linux — Specify Guest Processing Settings

To scan indexing data for indicators of compromise, select the Indicators of compromise detection check box. For more information, see Indicators of Compromise.

To keep the list of suspicious files and extensions as well as indicators of compromise up to date, select the Update malware definitions automatically check box. Veeam Backup & Replication will communicate with the Veeam Update Server (vbr.butler.veeam.com) daily and download the latest version of the SuspiciousFiles.xml file. By default, this occurs once a day at 12:00 AM.

To manage the list of suspicious files and extensions, from the main menu select Malware Detection > File Detection and click Suspicious files to monitor.

Adding Custom Suspicious Files and Extensions

To add custom files and extensions that should be marked as suspicious, do the following:

1. Click Add next to the Suspicious files field.
2. Specify a file extension or a file name with or without extension. You can also use * and ? wildcard characters. For example:

3. Click OK.

Excluding Suspicious Files and Extensions

To exclude a file name or file extension listed in the SuspiciousFiles.xml file and ignore it during the scan, do the following:

1. Click Add > Extension next to the Trusted objects field.
2. Specify a file name or file extension as it is listed in the SuspiciousFiles.xml file. For example:

3. Click OK.

Excluding Files and Folders

To ignore a specific file or a folder during the scan, do the following:

1. Click Add > Path next to the Trusted objects field.
2. Specify a path to the file or folder. For example:

3. Click OK.

Exporting and Importing Custom Lists

You can export and import the list of custom files and extensions to and from a file in the XML format.

To export the list, do the following:

1. Click Export these filters.
2. Click Browse and select the folder to save the list.
3. Specify the name of the file and click Save.
4. Click OK.

To import the list, do the following:

1. Click Import existing list.

2. Click Browse and select the folder where the file is located.
3. Select the file and click Open.
4. Click OK.

A valid XML schema for the list must contain the following elements:

Example:

Attack Tactics to Monitor

You can exclude specific indicators of compromise from monitoring. For more information about indicators of compromise, see Indicators of Compromise.

To disable an indicator of compromise, do the following:

1. From the main menu, select Malware Detection > File Detection and click Attack tactics to monitor.
2. Select the indicator of compromise you want to disable.
3. Click Disable.

To enable an indicator of compromise, do the following:

1. From the main menu, select Malware Detection > File Detection and click Attack tactics to monitor.
2. Select the indicator of compromise you want to enable.
3. Click Enable.

To restore default settings for all indicators of compromise, click Reset.