Windows: Commvault qlogin.exe targeting _+_PublicSharingUser_ with a GUID password

title: "Windows: Commvault qlogin.exe targeting _+_PublicSharingUser_ with a GUID password"
id: d9038474-4833-4305-844c-52d94fb70e5a
status: experimental
description: This rule flags Windows process creation where the command line contains both "qlogin" and the internal account "_+_PublicSharingUser_", and the same command line includes a GUID-formatted password. Attackers may use this pattern when attempting pre-auth abuse or unauthorized access paths that rely on crafted authentication inputs. Detection relies on process creation telemetry with full command-line capture to match the account string and GUID pattern.
references:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.001
  - detection.emerging-threats
  - cve.2025-57788
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - qlogin
      - _+_PublicSharingUser_
    CommandLine|re: "[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}"
  condition: selection
falsepositives:
  - Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.
level: medium
license: DRL-1.1
related:
  - id: 917789e1-2c1f-4bf5-8c91-6f71a017f469
    type: derived