DRMM-VeeamMalware.ps1

function write-DRMMAlert ($message) {
    write-host '<-Start Result->'
    write-host "Alert=$message"
    write-host '<-End Result->'
}

function write-DRMMStatus ($message) {
    write-host '<-Start Result->'
    write-host "STATUS=$message"
    write-host '<-End Result->'
}
function Write-DRMMDiagnostic ($message) {
    write-host '<-Start Diagnostic->'
    write-host $message
    write-host '<-End Diagnostic->'
}

# Get DRMM variables and set variables
$alertLevel = $ENV:AlertLevel
$verbose = $ENV:Verbose
$drmmOutput = @()

# If verbose enabled, start logging
if ($verbose -eq "True"){
    $timestamp = Get-Date -Format o | ForEach-Object { $_ -replace ":", "." }
    Start-Transcript -Path "C:\ProgramData\CentraStage\Temp\Veeam_Malware_$timestamp.txt" -Force
}

# Import require Powershell module
# Veeam.Backup.PowerShell
if (-not(Get-Module -ListAvailable -Name "Veeam.Backup.PowerShell")) {
    if (Get-Item "C:\Program Files\Veeam\Backup and Replication\Console\Veeam.Backup.PowerShell\Veeam.Backup.PowerShell.psd1") {
        Import-Module -Name "C:\Program Files\Veeam\Backup and Replication\Console\Veeam.Backup.PowerShell\Veeam.Backup.PowerShell.psd1"
    } else {
        Write-Host "Veeam PowerShell module not present and could not be found at the default location"
        Write-DRMMAlert "BAD | Missing PowerShell module"
        if ($verbose -eq "True") {
            Write-Host $(Get-Module -ListAvailable -Name Veeam*)
        }
        Exit 1
    }
} else {
    Import-Module "Veeam.Backup.PowerShell"
}

# Get Veeam restore points
Try {
    $points = Get-VBRObjectRestorePoint | Select-Object Name,CreationDate,Status | Sort-Object CreationDate
    if ($verbose -eq "True") {
        Write-Host "$($points.Count) restore points found"
    }

    # Examine them for malware status
    foreach ($point in $points) {
        if ($verbose -eq "True") {
            Write-Host "Checked $($point.Name) - $($point.CreationDate) - $($point.Status)"
        }

        switch($point.Status) {
            "Suspicious" {
                $suspicious = $true
                $drmmOutput += "? $($point.CreationDate) - $($point.Name) - SUSPICIOUS`n"
            }
            "Infected" {
                $infected = $true
                $drmmOutput += "! $($point.CreationDate) - $($point.Name) - INFECTED`n"
            }
        }
    }

    if ($infected -eq $true -and $alertLevel -ne "Suspicious") {
        write-DRMMAlert "BAD | VEEAM REPORTING INFECTED RESTORE POINTS"
        Write-DRMMDiagnostic $drmmOutput
        Exit 1
    } elseif ($suspicious -eq $true -and $alertlevel -ne "Infected"){
        Write-DRMMAlert "BAD | Veeam reporting suspicious restore points"
        Write-DRMMDiagnostic $drmmOutput
        Exit 1
    } else {
        Write-DRMMStatus "OK | No malware found"
    }
} catch {
    Write-DRMMAlert "BAD | Script failed - enable verbose mode and check output"
    Write-Host $_
    Exit 1
}