Emerging Threatmediumexperimental

Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)

Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Oct 20917789e1-2c1f-4bf5-8c91-6f71a017f4692025
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - 'qlogin'
            - '_+_PublicSharingUser_'
        # Detects the use of a GUID as the password, which is indicative of an exploit attempt
        CommandLine|re: '[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}'
    condition: selection
False Positives

Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.

Rule Metadata
Rule ID
917789e1-2c1f-4bf5-8c91-6f71a017f469
Status
experimental
Level
medium
Type
Emerging Threat
Created
Mon Oct 20
Path
rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.defense-evasionattack.initial-accessattack.t1078.001detection.emerging-threatscve.2025-57788
View on GitHub