Windows Process Creation: Commvault qoperation.exe Webshell Drop via -file to JSP in Webroot

title: "Windows Process Creation: Commvault qoperation.exe Webshell Drop via -file to JSP in Webroot"
id: 52bf720f-9f85-40e1-a114-bf2599d1e3e7
status: experimental
description: This rule flags suspicious execution of qoperation.exe with an exec subcommand and a -file argument that targets an Apache webroot path and ends in a .jsp extension. The combination of the specific ContentStore/Apache pathing and a JSP write strongly indicates an attempt to drop a webshell for persistence. It relies on Windows process creation telemetry, matching on the full command line contents.
references:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57790/proc_creation_win_exploit_cve_2025_57790.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
  - attack.persistence
  - attack.t1505.003
  - detection.emerging-threats
  - cve.2025-57790
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - qoperation
      - exec
      - " -af "
      - ".xml "
      - \Apache\webapps\ROOT\
      - .jsp
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bd3b3fff-a018-4994-9876-68af5809160f
    type: derived