Suspicious Child Process of PaperCut Server Component

Description

Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned unexpected Windows utilities such as charmap.exe as SYSTEM.

Query · eql

process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
  (
    process.name : (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "powershell_ise.exe",
      "wscript.exe",
      "cscript.exe",
      "mshta.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "bitsadmin.exe",
      "certutil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "calc.exe",
      "mspaint.exe"
    ) or
    ?process.pe.original_file_name : (
      "Cmd.Exe",
      "PowerShell.EXE",
      "pwsh.dll",
      "powershell_ise.EXE",
      "wscript.exe",
      "cscript.exe",
      "MSHTA.EXE",
      "RUNDLL32.EXE",
      "REGSVR32.EXE",
      "bitsadmin.exe",
      "CertUtil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "CALC.EXE",
      "mspaint.exe"
    )
  )

Investigation fields

Pivot points the source recommends for triage.

  • @timestamp
  • host.id
  • host.name
  • user.id
  • user.name
  • process.entity_id
  • process.pid
  • process.name
  • process.executable
  • process.command_line
  • process.pe.original_file_name
  • process.parent.name
  • process.parent.executable
  • process.parent.command_line

Implementation guide

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

Analyst notes

Investigating Suspicious Child Process of PaperCut Server Component

PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive components such as pc-printjob-spooler.exe should not routinely spawn interactive shells, download utilities, or discovery tools. CVE-2026-81578 (authentication bypass) chained with CVE-2026-82078 (unsafe dynamic class loading) enables pre-authentication remote code execution under pc-app.exe. Huntress observed short exploitation windows with base64-encoded commands such as whoami & ver and whoami & ver & tasklist, and reproduced RCE that spawned charmap.exe as SYSTEM under pc-app.exe. Separate telemetry has also shown pc-printjob-spooler.exe under Program Files\PaperCut Hive\ launching cmd.exe with attacker- or test-controlled command lines.

Possible investigation steps

  • Review the parent-child chain: process.parent.name/process.parent.executable (for example pc-app.exe or pc-printjob-spooler.exe under PaperCut* install paths); inspect child process.name, process.executable, and process.command_line for shells, LOLBins, discovery tools, or trivial probing commands such as echo test.
  • Confirm PaperCut product (NG/MF vs Hive), version, and internet exposure of management or print-related services. Unpatched or publicly reachable servers are high priority.
  • For NG/MF parents, search the same host.id for .class file creation under server\lib (for example Udydn.class, Moo97.class) and related artifacts under server\data\content (*.cmd, *.out).
  • Inspect PaperCut logs for hex-encoded payloads, base64 command strings, Derby boot messages referencing memory:...\pwn, jdbc:derby:memory:pwn, ERROR No suitable driver found for jdbc:no:x, or truncated/deleted logs.
  • Correlate with inbound web or print-service requests around @timestamp (proxy, WAF, firewall).
  • Pivot on user.id and host.id for follow-on credential access, persistence, or lateral movement within 48 hours.

False positive analysis

  • PaperCut upgrades, support tooling, or rare admin scripts might spawn expected helpers. Validate change windows, signed binaries, and command lines before exceptioning.
  • Do not exclude on pc-app.exe or pc-printjob-spooler.exe alone; require a stable benign child path and command pattern.

Response and remediation

  • Isolate or restrict network access to the implicated PaperCut service immediately if public-facing.
  • Preserve PaperCut logs, configuration, process trees from the parent binary, and any .class/.cmd/.out artifacts before upgrade or reboot.
  • Apply PaperCut Emergency Patch Release 2 (or newer fixed builds) for NG/MF, including site/secondary servers; validate Hive component versions and vendor guidance for Hive-specific hosts.
  • Hunt estate-wide for the same child-process and .class drop patterns; rotate credentials if compromise is confirmed.
Raw source Suspicious Child Process of PaperCut Server Component · Elastic TOML
Esc
Published by elastic/detection-rules ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[metadata]
creation_date = "2026/08/28"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/08/28"

[rule]
author = ["Elastic"]
description = """
Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF
Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of
CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve
pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from
PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF
in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned
unexpected Windows utilities such as charmap.exe as SYSTEM.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process-*",
    "winlogbeat-*",
    "logs-windows.sysmon_operational-*",
    "logs-windows.forwarded*",
    "logs-system.security*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Child Process of PaperCut Server Component"
note = """## Triage and analysis

### Investigating Suspicious Child Process of PaperCut Server Component

PaperCut NG/MF Application Server (`pc-app.exe`) and PaperCut Hive components such as `pc-printjob-spooler.exe` should
not routinely spawn interactive shells, download utilities, or discovery tools. CVE-2026-81578 (authentication bypass)
chained with CVE-2026-82078 (unsafe dynamic class loading) enables pre-authentication remote code execution under
`pc-app.exe`. Huntress observed short exploitation windows with base64-encoded commands such as `whoami & ver` and
`whoami & ver & tasklist`, and reproduced RCE that spawned `charmap.exe` as SYSTEM under `pc-app.exe`. Separate telemetry
has also shown `pc-printjob-spooler.exe` under `Program Files\\PaperCut Hive\\` launching `cmd.exe` with attacker- or
test-controlled command lines.

#### Possible investigation steps

- Review the parent-child chain: `process.parent.name`/`process.parent.executable` (for example `pc-app.exe` or
  `pc-printjob-spooler.exe` under `PaperCut*` install paths); inspect child `process.name`, `process.executable`, and
  `process.command_line` for shells, LOLBins, discovery tools, or trivial probing commands such as `echo test`.
- Confirm PaperCut product (NG/MF vs Hive), version, and internet exposure of management or print-related services.
  Unpatched or publicly reachable servers are high priority.
- For NG/MF parents, search the same `host.id` for `.class` file creation under `server\\lib` (for example `Udydn.class`,
  `Moo97.class`) and related artifacts under `server\\data\\content` (`*.cmd`, `*.out`).
- Inspect PaperCut logs for hex-encoded payloads, base64 command strings, Derby boot messages referencing
  `memory:...\\pwn`, `jdbc:derby:memory:pwn`, `ERROR No suitable driver found for jdbc:no:x`, or truncated/deleted logs.
- Correlate with inbound web or print-service requests around `@timestamp` (proxy, WAF, firewall).
- Pivot on `user.id` and `host.id` for follow-on credential access, persistence, or lateral movement within 48 hours.

### False positive analysis

- PaperCut upgrades, support tooling, or rare admin scripts might spawn expected helpers. Validate change windows,
  signed binaries, and command lines before exceptioning.
- Do not exclude on `pc-app.exe` or `pc-printjob-spooler.exe` alone; require a stable benign child path and command pattern.

### Response and remediation

- Isolate or restrict network access to the implicated PaperCut service immediately if public-facing.
- Preserve PaperCut logs, configuration, process trees from the parent binary, and any `.class`/`.cmd`/`.out` artifacts
  before upgrade or reboot.
- Apply PaperCut Emergency Patch Release 2 (or newer fixed builds) for NG/MF, including site/secondary servers; validate
  Hive component versions and vendor guidance for Hive-specific hosts.
- Hunt estate-wide for the same child-process and `.class` drop patterns; rotate credentials if compromise is confirmed.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [CrowdStrike](https://ela.st/crowdstrike-integration)
"""

references = [
    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
    "https://www.huntress.com/blog/papercut-actively-exploited",
]
risk_score = 73
rule_id = "1d0cf8ae-ed2c-4c74-bc01-462cfd928b64"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Initial Access",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Sysmon",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
  (
    process.name : (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "powershell_ise.exe",
      "wscript.exe",
      "cscript.exe",
      "mshta.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "bitsadmin.exe",
      "certutil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "calc.exe",
      "mspaint.exe"
    ) or
    ?process.pe.original_file_name : (
      "Cmd.Exe",
      "PowerShell.EXE",
      "pwsh.dll",
      "powershell_ise.EXE",
      "wscript.exe",
      "cscript.exe",
      "MSHTA.EXE",
      "RUNDLL32.EXE",
      "REGSVR32.EXE",
      "bitsadmin.exe",
      "CertUtil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "CALC.EXE",
      "mspaint.exe"
    )
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.id",
    "user.name",
    "process.entity_id",
    "process.pid",
    "process.name",
    "process.executable",
    "process.command_line",
    "process.pe.original_file_name",
    "process.parent.name",
    "process.parent.executable",
    "process.parent.command_line",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.