detection.wiki

Detection rules › Sigma

Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)

Status
experimental
Severity
high
Log source
product windows, category process_creation
Author
X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. An attacker can inject the -localadmin parameter via the password field to bypass authentication and gain a privileged token.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Commvault QLogin Argument Injection Authentication Bypass (CVE-2025-57791)
id: ff0225a0-1d9a-4bae-ab26-6038b18bb6d4
status: experimental
description: |
    Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791.
    An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.
references:
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
author: X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-20
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
    - cve.2025-57791
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'qlogin'
            - ' -cs '
            - ' -localadmin'
            - ' -clp '
            - '_localadmin__'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    CommandLine|contains|all:
        - 'qlogin'
        - ' -cs '
        - ' -localadmin'
        - ' -clp '
        - '_localadmin__'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -clp
  • -cs
  • -localadmin
  • _localadmin__
  • qlogin corpus 2 (sigma 2)