Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password

title: "Windows Process Creation: Commvault qlogin using _+_PublicSharingUser_ and GUID Password"
id: d9038474-4833-4305-844c-52d94fb70e5a
status: experimental
description: This rule flags qlogin.exe command lines that include both the internal _+_PublicSharingUser_ and a password value matching a GUID pattern. Such behavior can indicate an exploit attempt where an attacker uses a GUID-like credential to authenticate. It relies on Windows process creation telemetry with access to the full command line.
references:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078.001
  - detection.emerging-threats
  - cve.2025-57788
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - qlogin
      - _+_PublicSharingUser_
    CommandLine|re: "[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}"
  condition: selection
falsepositives:
  - Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.
level: medium
license: DRL-1.1
related:
  - id: 917789e1-2c1f-4bf5-8c91-6f71a017f469
    type: derived