Suspicious Java Class File Created in PaperCut Server Library

[metadata]
creation_date = "2026/08/28"
integration = ["endpoint"]
maturity = "production"
updated_date = "2026/08/28"

[rule]
author = ["Elastic"]
description = """
Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active
exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads
into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes
inside the PaperCut JVM / Application Server process.
"""
from = "now-9m"
index = ["logs-endpoint.events.file-*"]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Java Class File Created in PaperCut Server Library"
note = """## Triage and analysis

### Investigating Suspicious Java Class File Created in PaperCut Server Library

PaperCut NG/MF loads database/driver-related classes from the Application Server classpath. CVE-2026-82078 allows unsafe
dynamic class loading when configuration can be manipulated (enabled by CVE-2026-81578 authentication bypass). Huntress
recovered attacker `.class` files written under `server\\lib` (for example `Udydn.class`, `Moo97.class`) that decoded
commands, wrote output under `server\\data\\content`, then deleted staging files and often `server.log`.

#### Possible investigation steps

- Inspect `file.path`, `file.name`, `file.size`, and writing `process.executable`/`process.name`. Unexpected short or
  random `.class` names under `server/lib` are high confidence.
- On the same host, look for companion artifacts under `server/data/content` (`.cmd`, `.out`) and for suspicious
  `pc-app.exe` / Java child processes (shells, `whoami`, `tasklist`, `charmap.exe`).
- Review PaperCut `server/logs` for hex-encoded blobs, base64 command strings, `jdbc:derby:memory:pwn`, Derby boot paths
  containing `\\pwn`, or `ERROR No suitable driver found for jdbc:no:x`. Note missing/truncated `server.log` files.
- Confirm whether a PaperCut upgrade or emergency patch was running at `@timestamp`; legitimate upgrades also write
  many `.class` files under `server/lib`.
- Scope other PaperCut servers for the same file names/paths and review internet exposure of the management interface.

### False positive analysis

- PaperCut installation, upgrade, and emergency patch operations legitimately create `.class` files under `server/lib`.
  Correlate with change tickets, installer process names, and volume of writes before treating as malicious.
- Exclude only tightly scoped upgrade processes/paths after validation; do not blanket-exclude the `server/lib` directory.

### Response and remediation

- Restrict public access to the PaperCut Application Server immediately.
- Preserve `server/lib` `.class` files, `server/logs`, `server/data/content`, and process telemetry before cleanup or patch.
- Remove unauthorized `.class` payloads after evidence collection; apply PaperCut Emergency Patch Release 2 (or newer).
- Hunt for related child-process activity from `pc-app.exe` and rotate credentials if exploitation is confirmed.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend
"""

references = [
    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
    "https://www.huntress.com/blog/papercut-actively-exploited",
]
risk_score = 99
rule_id = "a2d4508e-e9c2-41f6-9466-0c3aed8cc2c9"
severity = "critical"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "OS: Linux",
    "OS: macOS",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Initial Access",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Data Source: Elastic Defend",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
file where host.os.type in ("windows", "linux", "macos") and
  event.action in ("creation", "overwrite") and
  file.extension : "class" and
  file.path : (
    "?:\\Program Files\\PaperCut*\\server\\lib\\*",
    "?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
    "/opt/papercut/server/lib/*",
    "/usr/local/papercut/server/lib/*",
    "/Applications/PaperCut*/server/lib/*"
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "host.os.type",
    "user.id",
    "user.name",
    "process.name",
    "process.executable",
    "file.path",
    "file.name",
    "file.size",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"