SIGNATURE_BASE_SUSP_EXPL_Commvault_CVE_2025_57791_Aug25_2

rule SIGNATURE_BASE_SUSP_EXPL_Commvault_CVE_2025_57791_Aug25_2 : FILE
{
	meta:
		description = "Detects potential exploit for WT-2025-0050, authentication bypass through QCommand argument injection"
		author = "X__Junior"
		id = "4a581a0d-bd1d-599d-a1b9-936dbcda75a8"
		date = "2025-08-21"
		modified = "2026-05-15"
		reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/expl_commvault_cve_2025_57791.yar#L17-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "61e3ddc09157badb2a1abf30da2cc35cac1a723db1134a37cb667be78209b845"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$sa1 = "_localadmin__"
		$sa2 = "-localadmin" base64

	condition:
		filesize < 20MB and all of them
}