Windows Process Creation: Commvault qlogin Argument Injection Indicators for Auth Bypass
Alerts on Windows command lines running Commvault qlogin with -localadmin-related markers consistent with argument injection.
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-10-20
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the Commvault qlogin command line contains a specific cluster of parameters and markers indicative of argument injection. An attacker can abuse crafted input to inject a -localadmin parameter via the password field, aiming to bypass authentication and obtain a privileged token. The detection relies on process creation telemetry and matches on the presence of qlogin plus specific command-line substrings.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Commvault qlogin Argument Injection Indicators for Auth Bypass"
id: 06c8febf-5588-48ce-b7ec-93908d020ef6
status: experimental
description: This rule flags Windows process creation events where the Commvault qlogin command line contains a specific cluster of parameters and markers indicative of argument injection. An attacker can abuse crafted input to inject a -localadmin parameter via the password field, aiming to bypass authentication and obtain a privileged token. The detection relies on process creation telemetry and matches on the presence of qlogin plus specific command-line substrings.
references:
- https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57791/proc_creation_win_exploit_cve_2025_57791.yml
author: X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
- attack.initial-access
- attack.t1190
- detection.emerging-threats
- cve.2025-57791
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- qlogin
- " -cs "
- " -localadmin"
- " -clp "
- _localadmin__
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: ff0225a0-1d9a-4bae-ab26-6038b18bb6d4
type: derived