SUSP_EXPL_CommVault_CVE_2025_57791_Aug25_2

rule SUSP_EXPL_CommVault_CVE_2025_57791_Aug25_2 {
   meta:
      description = "Detects potential exploit for WT-2025-0050, authentication bypass through QCommand argument injection"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      author = "X__Junior"
      date = "2025-08-21"
      score = 65
      id = "4a581a0d-bd1d-599d-a1b9-936dbcda75a8"
   strings:
      $sa1 = "_localadmin__"
      $sa2 = "-localadmin" base64
   condition:
      filesize < 20MB and all of them
}