EXPL_LOG_CommVault_CVE_2025_57791_Indicator_Shell_Drop_Aug25

rule EXPL_LOG_CommVault_CVE_2025_57791_Indicator_Shell_Drop_Aug25 {
   meta:
      description = "Detects suspicious log lines that indicate web shell drops into the Apache root folder of a Commvault installation"
      author = "Florian Roth"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      date = "2025-08-21"
      score = 70
      id = "efc7bcbc-6a38-5832-a12a-b8f9bd9125c1"
   strings:
      $xr1 = /Results written to \[[C-Z]:\\Program Files\\Commvault\\ContentStore\\Apache\\webapps\\ROOT\\[^\\]{1,20}\.jsp\]/  // https://regex101.com/r/KV8iK6/1
   condition:
      $xr1
}