Emerging Threatmediumexperimental
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Mon Oct 20917789e1-2c1f-4bf5-8c91-6f71a017f4692025
Emerging Threat
Active Threat
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic1 selector
detection:
selection:
CommandLine|contains|all:
- 'qlogin'
- '_+_PublicSharingUser_'
# Detects the use of a GUID as the password, which is indicative of an exploit attempt
CommandLine|re: '[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}'
condition: selectionFalse Positives
Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.
References
MITRE ATT&CK
Sub-techniques
Other
detection.emerging-threatscve.2025-57788
Rule Metadata
Rule ID
917789e1-2c1f-4bf5-8c91-6f71a017f469
Status
experimental
Level
medium
Type
Emerging Threat
Created
Mon Oct 20
Path
rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml
Raw Tags
attack.privilege-escalationattack.persistenceattack.defense-evasionattack.initial-accessattack.t1078.001detection.emerging-threatscve.2025-57788