Rule Info
Name
Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password.
This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
Date
2025-10-20 00:00:00
Modified
None
Id
917789e1-2c1f-4bf5-8c91-6f71a017f469
Tags
attack.privilege-escalation attack.persistence attack.defense-evasion attack.initial-access attack.t1078.001 detection.emerging-threats cve.2025-57788
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR