Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal

Hunt Hypothesis

This hunt hypothesis targets adversaries exploiting a post-authentication remote code execution vulnerability via QCommand path traversal to gain unauthorized access and execute arbitrary commands within authenticated sessions. Proactive hunting in Azure Sentinel is critical because this specific exploit allows attackers to bypass standard authentication controls, potentially leading to lateral movement or data exfiltration before traditional alerts trigger.

YARA Rule

rule EXPL_JSP_CommVault_CVE_2025_57791_Aug25_1 {
   meta:
      description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
      author = "X__Junior"
      date = "2025-08-21"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      score = 75
      id = "6fdfa207-6361-5dfb-b313-623d7cfa95f1"
   strings:
      $s1 = "<App_GetUserPropertiesResponse>" ascii
      $s2 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
   condition:
      filesize < 50KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the WT-2025-0049 detection rule, including suggested filters and exclusions:

Automated Backup Script Execution via Scheduled Task
- Scenario: An enterprise backup solution (e.g., Veeam or Commvault) runs a nightly scheduled task that invokes the QCommand utility to archive logs. The script passes dynamic file paths containing user-specific identifiers, which may include special characters or directory traversal sequences (..) that mimic the exploit signature.
- Filter/Exclusion: Create an exclusion for process names matching vss.exe, vcagent.exe, or specific backup service accounts (e.g., DOMAIN\BackupSvc). Additionally, filter events where the command line contains known backup flags like /backup-mode or /archive-target.
Internal Security Scanning Tool Utilizing QCommand
- Scenario: The internal vulnerability management platform (e.g., Tenable Nessus or Qualys) performs post-authentication scans on endpoints. During the scan, the agent executes QCommand to retrieve system configuration data, utilizing path traversal logic to access deep nested registry keys or file structures that trigger the RCE detection logic.
- Filter/Exclusion: Exclude events originating from known security scanner processes (e.g., nv1.exe, qualyspc.exe) running under a dedicated service account (e.g., DOMAIN\SecurityScanner). Add a condition to ignore alerts where the user context is a non-interactive service account rather than an interactive logged-in user.
IT Admin Performing Legacy Migration via PowerShell Wrapper
- Scenario: System administrators run custom PowerShell scripts during office hours to migrate legacy data. These scripts call QCommand with parameters that include relative paths (e.g., ..\Data\Legacy) to traverse from a root directory