Detects suspicious log lines that indicate web shell drops into the Apache root folder of a Commvault installation

Hunt Hypothesis

This hunt hypothesis targets adversaries who establish persistent access by deploying malicious web shells within the Apache root directory of Commvault installations to facilitate command execution and lateral movement. Proactively hunting for this behavior in Azure Sentinel is critical because the presence of unauthorized scripts in a high-privilege backup infrastructure often signals an early-stage compromise that could lead to data exfiltration or full system takeover if undetected.

YARA Rule

rule EXPL_LOG_CommVault_CVE_2025_57791_Indicator_Shell_Drop_Aug25 {
   meta:
      description = "Detects suspicious log lines that indicate web shell drops into the Apache root folder of a Commvault installation"
      author = "Florian Roth"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      date = "2025-08-21"
      score = 70
      id = "efc7bcbc-6a38-5832-a12a-b8f9bd9125c1"
   strings:
      $xr1 = /Results written to \[[C-Z]:\\Program Files\\Commvault\\ContentStore\\Apache\\webapps\\ROOT\\[^\\]{1,20}\.jsp\]/  // https://regex101.com/r/KV8iK6/1
   condition:
      $xr1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Commvault Web Shell Drop” detection rule, including suggested filters and exclusions:

• Scenario: Scheduled Commvault Content Store Maintenance

  • Context: The Commvault ContentStore service runs a nightly maintenance job (often triggered by the commvault_schedule cron task) that generates temporary diagnostic HTML reports within the Apache root (/opt/Commvault/Service/AVG/apache24/htdocs). These reports are often dropped as .html or .php files which mimic web shell artifacts.
  • Filter/Exclusion: Exclude file creation events where the source process is commvault_schedule (or PID associated with the Commvault daemon) and the destination path matches /opt/Commvault/Service/AVG/apache24/htdocs/maintenance_*.

• Scenario: Admin-Driven Dashboard Updates via CLI

  • Context: System administrators frequently use the commcell_admin CLI tool to push updated dashboard widgets or custom status pages. This action involves copying .php template files directly into the Apache root folder using standard Linux commands (cp, rsync) executed by a known service account (e.g., cvadmin).
  • Filter/Exclusion: Create an exclusion rule for file creation events where the user_account is cvadmin and the file extension is .php or .html, provided the event timestamp falls within standard business hours (08:00–18:00).

• Scenario: Automated Backup of Configuration Snapshots

  • Context: The Commvault backup engine periodically archives configuration snapshots to the web-accessible directory for remote auditing. This process, managed by the CommServe service, drops .xml or .json files that may be misinterpreted as shell scripts if they contain executable tags or are named