Windows Process Creation: Commvault qlogin Argument Injection Hints for -localadmin Bypass

title: "Windows Process Creation: Commvault qlogin Argument Injection Hints for -localadmin Bypass"
id: 06c8febf-5588-48ce-b7ec-93908d020ef6
status: experimental
description: This rule flags Windows process creation events where the command line for Commvault qlogin contains a set of strings consistent with argument injection, including occurrences of -localadmin and related localadmin markers. Attackers could use this technique to influence qlogin parameters and bypass authentication in the context of the referenced vulnerability behavior. Detection relies on process creation telemetry capturing the full command line arguments, allowing matching on the presence of the expected qlogin and localadmin-related substrings.
references:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57791/proc_creation_win_exploit_cve_2025_57791.yml
author: X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
  - attack.initial-access
  - attack.t1190
  - detection.emerging-threats
  - cve.2025-57791
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - qlogin
      - " -cs "
      - " -localadmin"
      - " -clp "
      - _localadmin__
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ff0225a0-1d9a-4bae-ab26-6038b18bb6d4
    type: derived