Suspicious Child Process of PaperCut Server Component

  1[metadata]
  2creation_date = "2026/08/28"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/08/28"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF
 11Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of
 12CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve
 13pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from
 14PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF
 15in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned
 16unexpected Windows utilities such as charmap.exe as SYSTEM.
 17"""
 18from = "now-9m"
 19index = [
 20    "logs-endpoint.events.process-*",
 21    "winlogbeat-*",
 22    "logs-windows.sysmon_operational-*",
 23    "logs-windows.forwarded*",
 24    "logs-system.security*",
 25    "endgame-*",
 26    "logs-m365_defender.event-*",
 27    "logs-sentinel_one_cloud_funnel.*",
 28    "logs-crowdstrike.fdr*",
 29]
 30language = "eql"
 31license = "Elastic License v2"
 32name = "Suspicious Child Process of PaperCut Server Component"
 33note = """## Triage and analysis
 34
 35### Investigating Suspicious Child Process of PaperCut Server Component
 36
 37PaperCut NG/MF Application Server (`pc-app.exe`) and PaperCut Hive components such as `pc-printjob-spooler.exe` should
 38not routinely spawn interactive shells, download utilities, or discovery tools. CVE-2026-81578 (authentication bypass)
 39chained with CVE-2026-82078 (unsafe dynamic class loading) enables pre-authentication remote code execution under
 40`pc-app.exe`. Huntress observed short exploitation windows with base64-encoded commands such as `whoami & ver` and
 41`whoami & ver & tasklist`, and reproduced RCE that spawned `charmap.exe` as SYSTEM under `pc-app.exe`. Separate telemetry
 42has also shown `pc-printjob-spooler.exe` under `Program Files\\PaperCut Hive\\` launching `cmd.exe` with attacker- or
 43test-controlled command lines.
 44
 45#### Possible investigation steps
 46
 47- Review the parent-child chain: `process.parent.name`/`process.parent.executable` (for example `pc-app.exe` or
 48  `pc-printjob-spooler.exe` under `PaperCut*` install paths); inspect child `process.name`, `process.executable`, and
 49  `process.command_line` for shells, LOLBins, discovery tools, or trivial probing commands such as `echo test`.
 50- Confirm PaperCut product (NG/MF vs Hive), version, and internet exposure of management or print-related services.
 51  Unpatched or publicly reachable servers are high priority.
 52- For NG/MF parents, search the same `host.id` for `.class` file creation under `server\\lib` (for example `Udydn.class`,
 53  `Moo97.class`) and related artifacts under `server\\data\\content` (`*.cmd`, `*.out`).
 54- Inspect PaperCut logs for hex-encoded payloads, base64 command strings, Derby boot messages referencing
 55  `memory:...\\pwn`, `jdbc:derby:memory:pwn`, `ERROR No suitable driver found for jdbc:no:x`, or truncated/deleted logs.
 56- Correlate with inbound web or print-service requests around `@timestamp` (proxy, WAF, firewall).
 57- Pivot on `user.id` and `host.id` for follow-on credential access, persistence, or lateral movement within 48 hours.
 58
 59### False positive analysis
 60
 61- PaperCut upgrades, support tooling, or rare admin scripts might spawn expected helpers. Validate change windows,
 62  signed binaries, and command lines before exceptioning.
 63- Do not exclude on `pc-app.exe` or `pc-printjob-spooler.exe` alone; require a stable benign child path and command pattern.
 64
 65### Response and remediation
 66
 67- Isolate or restrict network access to the implicated PaperCut service immediately if public-facing.
 68- Preserve PaperCut logs, configuration, process trees from the parent binary, and any `.class`/`.cmd`/`.out` artifacts
 69  before upgrade or reboot.
 70- Apply PaperCut Emergency Patch Release 2 (or newer fixed builds) for NG/MF, including site/secondary servers; validate
 71  Hive component versions and vendor guidance for Hive-specific hosts.
 72- Hunt estate-wide for the same child-process and `.class` drop patterns; rotate credentials if compromise is confirmed.
 73"""
 74
 75setup = """## Setup
 76
 77This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 78
 79Setup instructions: https://ela.st/install-elastic-defend
 80
 81### Additional data sources
 82
 83This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 84
 85- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
 86- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
 87- [Microsoft Defender XDR](https://ela.st/m365-defender)
 88- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 89- [CrowdStrike](https://ela.st/crowdstrike-integration)
 90"""
 91
 92references = [
 93    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
 94    "https://www.huntress.com/blog/papercut-actively-exploited",
 95]
 96risk_score = 73
 97rule_id = "1d0cf8ae-ed2c-4c74-bc01-462cfd928b64"
 98severity = "high"
 99tags = [
100    "Domain: Endpoint",
101    "OS: Windows",
102    "Use Case: Threat Detection",
103    "Use Case: Vulnerability",
104    "Tactic: Initial Access",
105    "Tactic: Execution",
106    "Data Source: Elastic Defend",
107    "Data Source: Elastic Endgame",
108    "Data Source: Sysmon",
109    "Data Source: Windows Security Event Logs",
110    "Data Source: Microsoft Defender XDR",
111    "Data Source: SentinelOne",
112    "Data Source: Crowdstrike",
113    "Resources: Investigation Guide",
114]
115timestamp_override = "event.ingested"
116type = "eql"
117
118query = '''
119process where host.os.type == "windows" and event.type == "start" and
120  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
121  (
122    process.name : (
123      "cmd.exe",
124      "powershell.exe",
125      "pwsh.exe",
126      "powershell_ise.exe",
127      "wscript.exe",
128      "cscript.exe",
129      "mshta.exe",
130      "rundll32.exe",
131      "regsvr32.exe",
132      "bitsadmin.exe",
133      "certutil.exe",
134      "curl.exe",
135      "wget.exe",
136      "net.exe",
137      "net1.exe",
138      "whoami.exe",
139      "tasklist.exe",
140      "ipconfig.exe",
141      "nltest.exe",
142      "systeminfo.exe",
143      "charmap.exe",
144      "calc.exe",
145      "mspaint.exe"
146    ) or
147    ?process.pe.original_file_name : (
148      "Cmd.Exe",
149      "PowerShell.EXE",
150      "pwsh.dll",
151      "powershell_ise.EXE",
152      "wscript.exe",
153      "cscript.exe",
154      "MSHTA.EXE",
155      "RUNDLL32.EXE",
156      "REGSVR32.EXE",
157      "bitsadmin.exe",
158      "CertUtil.exe",
159      "curl.exe",
160      "wget.exe",
161      "net.exe",
162      "net1.exe",
163      "whoami.exe",
164      "tasklist.exe",
165      "ipconfig.exe",
166      "nltest.exe",
167      "systeminfo.exe",
168      "charmap.exe",
169      "CALC.EXE",
170      "mspaint.exe"
171    )
172  )
173'''
174
175[rule.investigation_fields]
176field_names = [
177    "@timestamp",
178    "host.id",
179    "host.name",
180    "user.id",
181    "user.name",
182    "process.entity_id",
183    "process.pid",
184    "process.name",
185    "process.executable",
186    "process.command_line",
187    "process.pe.original_file_name",
188    "process.parent.name",
189    "process.parent.executable",
190    "process.parent.command_line",
191]
192
193[[rule.threat]]
194framework = "MITRE ATT&CK"
195
196[[rule.threat.technique]]
197id = "T1190"
198name = "Exploit Public-Facing Application"
199reference = "https://attack.mitre.org/techniques/T1190/"
200
201[rule.threat.tactic]
202id = "TA0001"
203name = "Initial Access"
204reference = "https://attack.mitre.org/tactics/TA0001/"
205
206[[rule.threat]]
207framework = "MITRE ATT&CK"
208
209[[rule.threat.technique]]
210id = "T1059"
211name = "Command and Scripting Interpreter"
212reference = "https://attack.mitre.org/techniques/T1059/"
213
214[[rule.threat.technique.subtechnique]]
215id = "T1059.001"
216name = "PowerShell"
217reference = "https://attack.mitre.org/techniques/T1059/001/"
218
219[[rule.threat.technique.subtechnique]]
220id = "T1059.003"
221name = "Windows Command Shell"
222reference = "https://attack.mitre.org/techniques/T1059/003/"
223
224[rule.threat.tactic]
225id = "TA0002"
226name = "Execution"
227reference = "https://attack.mitre.org/tactics/TA0002/"