Technical Note: Veeam DDL Alerts

TABLE OF CONTENTS

• Problem
• Symptoms
• Why this happens
• What to do
• Verification

Problem

Customers may observe repeated buffer-related alerts tied to Veeam processes and temporary DLL files created in the Windows temp directory.

Symptoms

• Alerts appear at frequent intervals, such as every minute.

• The alert references temporary DLL files in the Windows temp path.

• The file name changes each time, even though the originating application pattern is similar.

• Associated activity may reference Veeam services or related supporting processes.

Why this happens

This behavior can be expected when an application generates temporary, uniquely named files during normal operation. Since each file is new and distinct, the platform may not find an existing trust association for that buffer, which leads to repeated alerts even though the parent application behavior is consistent.

Temporary files that are recreated with unique names can trigger repeated trust-related buffer alerts because each artifact is evaluated as a new object.

What to do

Review the alert details to confirm that the activity is coming from known, approved Veeam components in your environment.

1. Verify the related process is an approved Veeam executable in your environment.

2. Confirm the temporary file creation pattern matches expected Veeam activity.

3. If the activity is verified as legitimate, apply the appropriate allowlist or ignore policy for the relevant process pattern according to your organization's security policy.

Verification

After policy updates are applied, confirm that:

• The same known Veeam activity is no longer generating unnecessary repeated alerts.

• No unrelated processes are covered by the exception.

• Normal monitoring remains in place for unexpected or unknown activity.