CVE-2025-3928

Sentinel/Defender KQL

DeviceFileEvents
| where FolderPath contains "Commvault" and (FileName endswith ".jsp" or FileName endswith ".php" or FileName endswith ".asp" or FileName endswith ".aspx")
| where InitiatingProcessCommandLine contains "webshell" or InitiatingProcessCommandLine contains "cmd.exe" or InitiatingProcessCommandLine contains "powershell.exe"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType
| join kind=inner (DeviceProcessEvents
    | where InitiatingProcessParentFileName =~ "Commvault.exe" or InitiatingProcessParentFileName =~ "cvd.exe"
    | project ProcessId, ProcessCommandLine, FileName, InitiatingProcessParentFileName, DeviceName, Timestamp
) on DeviceName
| where Timestamp between (ago(7d) .. now()) and InitiatingProcessCommandLine contains "webshell" or ProcessCommandLine contains "webshell"

Splunk SPL

index=* (sourcetype=commvault OR sourcetype=windows_security OR sourcetype=linux_audit)
| (file_path=*Commvault* AND (file_name=*.jsp OR file_name=*.php OR file_name=*.asp OR file_name=*.aspx) AND (process_command_line=*webshell* OR process_command_line=*cmd.exe* OR process_command_line=*powershell.exe*))
| stats count by _time, host, file_path, file_name, process_command_line
| search process_parent_name=Commvault.exe OR process_parent_name=cvd.exe

Sigma

title: Commvault Webshell Detection
status: experimental
description: Detects potential webshell creation and execution on Commvault Web Servers.
author: SecBoard
date: 2025/05/23
logsource:
  category: file_event
  product: windows
  service: sysmon
detection:
  selection_file:
    EventID: 11 # FileCreate
    TargetFilename|endswith:
      - '.jsp'
      - '.php'
      - '.asp'
      - '.aspx'
    Image|contains: 'Commvault'
  selection_process:
    EventID: 1 # ProcessCreate
    ParentImage|contains: 'Commvault'
    CommandLine|contains:
      - 'webshell'
      - 'cmd.exe'
      - 'powershell.exe'
  condition: selection_file or selection_process
fields:
  - Image
  - ParentImage
  - TargetFilename
  - CommandLine
tags:
  - attack.persistence
  - attack.execution
  - cve.2025.3928

Elastic ES|QL

file where event.action == "creation" and file.path : "*Commvault*" and (file.extension : ("jsp", "php", "asp", "aspx")) and (process.command_line : "*webshell*" or process.command_line : "*cmd.exe*" or process.command_line : "*powershell.exe*")
or process where event.action == "start" and (process.parent.executable : "Commvault.exe" or process.parent.executable : "cvd.exe") and (process.command_line : "*webshell*" or process.command_line : "*cmd.exe*" or process.command_line : "*powershell.exe*")