Suspicious Java Class File Created in PaperCut Server Library

  1[metadata]
  2creation_date = "2026/08/28"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/28"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active
 11exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads
 12into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes
 13inside the PaperCut JVM / Application Server process.
 14"""
 15from = "now-9m"
 16index = ["logs-endpoint.events.file-*"]
 17language = "eql"
 18license = "Elastic License v2"
 19name = "Suspicious Java Class File Created in PaperCut Server Library"
 20note = """## Triage and analysis
 21
 22### Investigating Suspicious Java Class File Created in PaperCut Server Library
 23
 24PaperCut NG/MF loads database/driver-related classes from the Application Server classpath. CVE-2026-82078 allows unsafe
 25dynamic class loading when configuration can be manipulated (enabled by CVE-2026-81578 authentication bypass). Huntress
 26recovered attacker `.class` files written under `server\\lib` (for example `Udydn.class`, `Moo97.class`) that decoded
 27commands, wrote output under `server\\data\\content`, then deleted staging files and often `server.log`.
 28
 29#### Possible investigation steps
 30
 31- Inspect `file.path`, `file.name`, `file.size`, and writing `process.executable`/`process.name`. Unexpected short or
 32  random `.class` names under `server/lib` are high confidence.
 33- On the same host, look for companion artifacts under `server/data/content` (`.cmd`, `.out`) and for suspicious
 34  `pc-app.exe` / Java child processes (shells, `whoami`, `tasklist`, `charmap.exe`).
 35- Review PaperCut `server/logs` for hex-encoded blobs, base64 command strings, `jdbc:derby:memory:pwn`, Derby boot paths
 36  containing `\\pwn`, or `ERROR No suitable driver found for jdbc:no:x`. Note missing/truncated `server.log` files.
 37- Confirm whether a PaperCut upgrade or emergency patch was running at `@timestamp`; legitimate upgrades also write
 38  many `.class` files under `server/lib`.
 39- Scope other PaperCut servers for the same file names/paths and review internet exposure of the management interface.
 40
 41### False positive analysis
 42
 43- PaperCut installation, upgrade, and emergency patch operations legitimately create `.class` files under `server/lib`.
 44  Correlate with change tickets, installer process names, and volume of writes before treating as malicious.
 45- Exclude only tightly scoped upgrade processes/paths after validation; do not blanket-exclude the `server/lib` directory.
 46
 47### Response and remediation
 48
 49- Restrict public access to the PaperCut Application Server immediately.
 50- Preserve `server/lib` `.class` files, `server/logs`, `server/data/content`, and process telemetry before cleanup or patch.
 51- Remove unauthorized `.class` payloads after evidence collection; apply PaperCut Emergency Patch Release 2 (or newer).
 52- Hunt for related child-process activity from `pc-app.exe` and rotate credentials if exploitation is confirmed.
 53"""
 54
 55setup = """## Setup
 56
 57This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 58
 59Setup instructions: https://ela.st/install-elastic-defend
 60"""
 61
 62references = [
 63    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
 64    "https://www.huntress.com/blog/papercut-actively-exploited",
 65]
 66risk_score = 99
 67rule_id = "a2d4508e-e9c2-41f6-9466-0c3aed8cc2c9"
 68severity = "critical"
 69tags = [
 70    "Domain: Endpoint",
 71    "OS: Windows",
 72    "OS: Linux",
 73    "OS: macOS",
 74    "Use Case: Threat Detection",
 75    "Use Case: Vulnerability",
 76    "Tactic: Initial Access",
 77    "Tactic: Execution",
 78    "Tactic: Defense Evasion",
 79    "Data Source: Elastic Defend",
 80    "Resources: Investigation Guide",
 81]
 82timestamp_override = "event.ingested"
 83type = "eql"
 84
 85query = '''
 86file where host.os.type in ("windows", "linux", "macos") and
 87  event.action in ("creation", "overwrite") and
 88  file.extension : "class" and
 89  file.path : (
 90    "?:\\Program Files\\PaperCut*\\server\\lib\\*",
 91    "?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
 92    "/opt/papercut/server/lib/*",
 93    "/usr/local/papercut/server/lib/*",
 94    "/Applications/PaperCut*/server/lib/*"
 95  )
 96'''
 97
 98[rule.investigation_fields]
 99field_names = [
100    "@timestamp",
101    "host.id",
102    "host.name",
103    "host.os.type",
104    "user.id",
105    "user.name",
106    "process.name",
107    "process.executable",
108    "file.path",
109    "file.name",
110    "file.size",
111]
112
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115
116[[rule.threat.technique]]
117id = "T1190"
118name = "Exploit Public-Facing Application"
119reference = "https://attack.mitre.org/techniques/T1190/"
120
121[rule.threat.tactic]
122id = "TA0001"
123name = "Initial Access"
124reference = "https://attack.mitre.org/tactics/TA0001/"
125
126[[rule.threat]]
127framework = "MITRE ATT&CK"
128
129[[rule.threat.technique]]
130id = "T1059"
131name = "Command and Scripting Interpreter"
132reference = "https://attack.mitre.org/techniques/T1059/"
133
134[rule.threat.tactic]
135id = "TA0002"
136name = "Execution"
137reference = "https://attack.mitre.org/tactics/TA0002/"
138
139[[rule.threat]]
140framework = "MITRE ATT&CK"
141
142[[rule.threat.technique]]
143id = "T1620"
144name = "Reflective Code Loading"
145reference = "https://attack.mitre.org/techniques/T1620/"
146
147[rule.threat.tactic]
148id = "TA0005"
149name = "Defense Evasion"
150reference = "https://attack.mitre.org/tactics/TA0005/"