Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password. This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.