Suspicious Child Process of PaperCut Server Component

Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned unexpected Windows utilities such as charmap.exe as SYSTEM.

Rule type: eql
Rule indices:

  • logs-endpoint.events.process-*
  • winlogbeat-*
  • logs-windows.sysmon_operational-*
  • logs-windows.forwarded*
  • logs-system.security*
  • endgame-*
  • logs-m365_defender.event-*
  • logs-sentinel_one_cloud_funnel.*
  • logs-crowdstrike.fdr*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Use Case: Vulnerability
  • Tactic: Initial Access
  • Tactic: Execution
  • Data Source: Elastic Defend
  • Data Source: Elastic Endgame
  • Data Source: Sysmon
  • Data Source: Windows Security Event Logs
  • Data Source: Microsoft Defender XDR
  • Data Source: SentinelOne
  • Data Source: Crowdstrike
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive components such as pc-printjob-spooler.exe should not routinely spawn interactive shells, download utilities, or discovery tools. CVE-2026-81578 (authentication bypass) chained with CVE-2026-82078 (unsafe dynamic class loading) enables pre-authentication remote code execution under pc-app.exe. Huntress observed short exploitation windows with base64-encoded commands such as whoami & ver and whoami & ver & tasklist, and reproduced RCE that spawned charmap.exe as SYSTEM under pc-app.exe. Separate telemetry has also shown pc-printjob-spooler.exe under Program Files\PaperCut Hive\ launching cmd.exe with attacker- or test-controlled command lines.

  • Review the parent-child chain: process.parent.name/process.parent.executable (for example pc-app.exe or pc-printjob-spooler.exe under PaperCut* install paths); inspect child process.name, process.executable, and process.command_line for shells, LOLBins, discovery tools, or trivial probing commands such as echo test.
  • Confirm PaperCut product (NG/MF vs Hive), version, and internet exposure of management or print-related services. Unpatched or publicly reachable servers are high priority.
  • For NG/MF parents, search the same host.id for .class file creation under server\lib (for example Udydn.class, Moo97.class) and related artifacts under server\data\content (*.cmd, *.out).
  • Inspect PaperCut logs for hex-encoded payloads, base64 command strings, Derby boot messages referencing memory:...\pwn, jdbc:derby:memory:pwn, ERROR No suitable driver found for jdbc:no:x, or truncated/deleted logs.
  • Correlate with inbound web or print-service requests around @timestamp (proxy, WAF, firewall).
  • Pivot on user.id and host.id for follow-on credential access, persistence, or lateral movement within 48 hours.
  • PaperCut upgrades, support tooling, or rare admin scripts might spawn expected helpers. Validate change windows, signed binaries, and command lines before exceptioning.
  • Do not exclude on pc-app.exe or pc-printjob-spooler.exe alone; require a stable benign child path and command pattern.
  • Isolate or restrict network access to the implicated PaperCut service immediately if public-facing.
  • Preserve PaperCut logs, configuration, process trees from the parent binary, and any .class/.cmd/.out artifacts before upgrade or reboot.
  • Apply PaperCut Emergency Patch Release 2 (or newer fixed builds) for NG/MF, including site/secondary servers; validate Hive component versions and vendor guidance for Hive-specific hosts.
  • Hunt estate-wide for the same child-process and .class drop patterns; rotate credentials if compromise is confirmed.
process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
  (
    process.name : (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "powershell_ise.exe",
      "wscript.exe",
      "cscript.exe",
      "mshta.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "bitsadmin.exe",
      "certutil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "calc.exe",
      "mspaint.exe"
    ) or
    ?process.pe.original_file_name : (
      "Cmd.Exe",
      "PowerShell.EXE",
      "pwsh.dll",
      "powershell_ise.EXE",
      "wscript.exe",
      "cscript.exe",
      "MSHTA.EXE",
      "RUNDLL32.EXE",
      "REGSVR32.EXE",
      "bitsadmin.exe",
      "CertUtil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "CALC.EXE",
      "mspaint.exe"
    )
  )

Framework: MITRE ATT&CK

Framework: MITRE ATT&CK