Commvault Server Hostname Observed in HTTP Response

Tim Peck@timpeck

•updated Nov 10, 2025•0•19

This rule detects the presence of 'activeMQConnectionURL' and 'tcp://' within HTTP response bodies, which is indicative of a Commvault server exposing its hostname or connection details. This information could be leveraged by attackers for reconnaissance or to identify vulnerable Commvault instances.