Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal

Hunt Hypothesis

This hunt hypothesis targets adversaries leveraging a post-authentication remote code execution vulnerability (WT-2025-0049) combined with QCommand path traversal to execute arbitrary commands on compromised systems. Proactive hunting in Azure Sentinel is critical because this specific exploit chain allows attackers to bypass initial authentication controls and establish persistent access, necessitating immediate identification of anomalous command patterns before lateral movement occurs.

YARA Rule

rule EXPL_JSP_CommVault_CVE_2025_57791_Aug25_2 {
   meta:
      description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
      author = "X__Junior"
      date = "2025-08-21"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      score = 75
      id = "068e1598-bcde-579d-910a-449a7ad903d6"
   strings:
      $s1 = "<App_UpdateUserPropertiesRequest>" ascii
      $s2 = "<description>" ascii
      $s3 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
   condition:
      filesize < 50KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
• Source Rule

False Positive Guidance

Here are 3-5 specific false positive scenarios for the WT-2025-0049 detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Backup Script Execution via QCommand

  • Context: The enterprise runs a nightly maintenance job using QCommand to archive logs from the C:\Logs\Archived directory. The script explicitly constructs a path string that includes user input (e.g., date stamps) which may contain characters triggering the path traversal logic.
  • Filter/Exclusion: Create an exclusion for processes spawned by the specific backup service account (e.g., svc-backup) where the command line contains the known backup script hash or the specific directory path C:\Logs\Archived.
  • Logic: ProcessAccount == 'svc-backup' AND CommandLine CONTAINS 'QCommand.exe /path:...'

• Scenario: Admin Manual File Migration via QCommand CLI

  • Context: A System Administrator manually executes a migration task using the QCommand CLI tool to move configuration files between servers. The admin passes a long, dynamic path argument (e.g., \\FileServer\Share\Dept-IT\Configs) which includes forward slashes and special characters that mimic the traversal attack pattern.
  • Filter/Exclusion: Exclude events where the source user is a member of the “Domain Admins” or “Helpdesk_Ops” group, and the command line arguments do not contain suspicious path sequences like .. (double dot) followed by a directory separator outside of standard root directories.
  • Logic: UserGroup IN ('Domain Admins', 'Helpdesk_Ops') AND CommandLine NOT CONTAINS '..\..'

• Scenario: Automated Deployment Pipeline (CI/CD)

  • Context: The DevOps team