huntrule

Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop

Alerts on qoperation.exe commands that use -file to write a .jsp into a webroot path, consistent with a webshell drop.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2025-10-20
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies suspicious use of qoperation.exe execution that includes arguments indicating an attempt to write a .jsp file into an Apache webroot path. Such behavior is consistent with a webshell drop, where attackers place executable content into a server-accessible directory for persistence and remote access. It relies on process creation telemetry with access to the full command line to match the required argument patterns and target web directory. The detection is designed around the post-authentication exploitation flow associated with CVE-2025-57790 as referenced by the rule.

Reporting behind it

Related detections9 linkedT1505.003 — drag to rearrange
Suspicious SD-WAN Compromise JSP Webshell Access
Malicious AquaShell Webshell Access on Cisco Secure Email Gateway by UAT-9686
Malicious IIS Worker Process Spawning Command Shell Reconnaissance
Malicious StyleSmuggler (CVE-2026-75650) Web Shell Dropped In Magento Product Image Cache (via file_event)
Suspicious Web Shell File Written to IIS wwwroot Directory
Possible Citrix ShareFile Unauthenticated Upload Path Traversal Webshell (CVE-2023-24489) (via webserver)
Possible Unauthenticated Admin Creation in Dynamicweb CVE-2022-25369
Possible DotCMS Path Traversal Webshell Upload via content API CVE-2022-26352
Possible Avaya Aura Device Services WebDAV PHP Webshell Upload via PhoneBackup (via webserver)
Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop
Pivot detection · T1505.003 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.