Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. This is a post-authentication step corresponding to CVE-2025-57790.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.003` Server Software Component: Web Shell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Commvault QOperation Path Traversal Webshell Drop (CVE-2025-57790)
id: bd3b3fff-a018-4994-9876-68af5809160f
status: experimental
description: |
    Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop.
    This is a post-authentication step corresponding to CVE-2025-57790.
references:
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-20
tags:
    - attack.persistence
    - attack.t1505.003
    - detection.emerging-threats
    - cve.2025-57790
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # qoperation execute -af F:\Program Files\Commvault\ContentStore\Reports\MetricsUpload\Upload\ABC1234\rekt.xml -file F:\Program Files\Commvault\ContentStore\Apache\webapps\ROOT\wT-poc.jsp
        CommandLine|contains|all:
            - 'qoperation'
            - 'exec'
            - ' -af '
            - '.xml '
            - '\Apache\webapps\ROOT\'
            - '.jsp'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CommandLine|contains|all:
        - 'qoperation'
        - 'exec'
        - ' -af '
        - '.xml '
        - '\Apache\webapps\ROOT\'
        - '.jsp'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-af` corpus 3 (sigma 3) `.jsp` corpus 2 (sigma 2) `.xml` `\Apache\webapps\ROOT\` `exec` corpus 10 (elastic 6, sigma 2, splunk 2) `qoperation`	`field:"CommandLine" kind:match`