Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password
Alert on qlogin.exe commands that authenticate as _+_PublicSharingUser_ using a GUID-formatted password.
FreeReviewedSigma · Medium · v5
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-10-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags qlogin.exe command lines that include both the internal _+_PublicSharingUser_ and a password value matching a GUID pattern. Such behavior can indicate an exploit attempt where an attacker uses a GUID-like credential to authenticate. It relies on Windows process creation telemetry with access to the full command line.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-commvault-qlogin-exe-targeting-publicsharinguser-with-a-guid-password-917789e1
title: "Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password"
id: d9038474-4833-4305-844c-52d94fb70e5a
status: experimental
description: This rule flags qlogin.exe command lines that include both the internal _+_PublicSharingUser_ and a password value matching a GUID pattern. Such behavior can indicate an exploit attempt where an attacker uses a GUID-like credential to authenticate. It relies on Windows process creation telemetry with access to the full command line.
references:
- https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.stealth
- attack.t1078.001
- detection.emerging-threats
- cve.2025-57788
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- qlogin
- _+_PublicSharingUser_
CommandLine|re: "[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}"
condition: selection
falsepositives:
- Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.
level: medium
license: DRL-1.1
related:
- id: 917789e1-2c1f-4bf5-8c91-6f71a017f469
type: derived