Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop
Alerts on qoperation.exe commands that use -file to write a .jsp into a webroot path, consistent with a webshell drop.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-10-20
- Updated
- 2026-07-31
ATT&CK techniques
PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies suspicious use of qoperation.exe execution that includes arguments indicating an attempt to write a .jsp file into an Apache webroot path. Such behavior is consistent with a webshell drop, where attackers place executable content into a server-accessible directory for persistence and remote access. It relies on process creation telemetry with access to the full command line to match the required argument patterns and target web directory. The detection is designed around the post-authentication exploitation flow associated with CVE-2025-57790 as referenced by the rule.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop"
id: 52bf720f-9f85-40e1-a114-bf2599d1e3e7
status: experimental
description: This rule identifies suspicious use of qoperation.exe execution that includes arguments indicating an attempt to write a .jsp file into an Apache webroot path. Such behavior is consistent with a webshell drop, where attackers place executable content into a server-accessible directory for persistence and remote access. It relies on process creation telemetry with access to the full command line to match the required argument patterns and target web directory. The detection is designed around the post-authentication exploitation flow associated with CVE-2025-57790 as referenced by the rule.
references:
- https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Exploits/CVE-2025-57790/proc_creation_win_exploit_cve_2025_57790.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-10-20
tags:
- attack.persistence
- attack.t1505.003
- detection.emerging-threats
- cve.2025-57790
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- qoperation
- exec
- " -af "
- ".xml "
- \Apache\webapps\ROOT\
- .jsp
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: bd3b3fff-a018-4994-9876-68af5809160f
type: derived