SUSP_EXPL_CommVault_CVE_2025_57791_Artifact_Aug25

rule SUSP_EXPL_CommVault_CVE_2025_57791_Artifact_Aug25 {
   meta:
      description = "Detects exploit artifact for WT-2025-0050, authentication bypass through QCommand argument injection"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      author = "X__Junior"
      date = "2025-08-21"
      score = 75
      id = "9ac37635-fd8b-5241-abc2-bf39bab5ccdf"
   strings:
      $sa1 = "_localadmin__"
      $sa2 = /-cs [a-zA-Z0-9-{}]{3,32} -cs /

      $sb2 = "-localadmin" base64
      $sb1 = "-localadmin"
   condition:
      filesize < 20MB and all of ($sa*) and 1 of ($sb*)
}