Suspicious Child Process of PaperCut Server Component

[metadata]
creation_date = "2026/08/28"
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/08/28"

[rule]
author = ["Elastic"]
description = """
Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF
Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of
CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve
pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from
PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF
in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned
unexpected Windows utilities such as charmap.exe as SYSTEM.
"""
from = "now-9m"
index = [
    "logs-endpoint.events.process-*",
    "winlogbeat-*",
    "logs-windows.sysmon_operational-*",
    "logs-windows.forwarded*",
    "logs-system.security*",
    "endgame-*",
    "logs-m365_defender.event-*",
    "logs-sentinel_one_cloud_funnel.*",
    "logs-crowdstrike.fdr*",
]
language = "eql"
license = "Elastic License v2"
name = "Suspicious Child Process of PaperCut Server Component"
note = """## Triage and analysis

### Investigating Suspicious Child Process of PaperCut Server Component

PaperCut NG/MF Application Server (`pc-app.exe`) and PaperCut Hive components such as `pc-printjob-spooler.exe` should
not routinely spawn interactive shells, download utilities, or discovery tools. CVE-2026-81578 (authentication bypass)
chained with CVE-2026-82078 (unsafe dynamic class loading) enables pre-authentication remote code execution under
`pc-app.exe`. Huntress observed short exploitation windows with base64-encoded commands such as `whoami & ver` and
`whoami & ver & tasklist`, and reproduced RCE that spawned `charmap.exe` as SYSTEM under `pc-app.exe`. Separate telemetry
has also shown `pc-printjob-spooler.exe` under `Program Files\\PaperCut Hive\\` launching `cmd.exe` with attacker- or
test-controlled command lines.

#### Possible investigation steps

- Review the parent-child chain: `process.parent.name`/`process.parent.executable` (for example `pc-app.exe` or
  `pc-printjob-spooler.exe` under `PaperCut*` install paths); inspect child `process.name`, `process.executable`, and
  `process.command_line` for shells, LOLBins, discovery tools, or trivial probing commands such as `echo test`.
- Confirm PaperCut product (NG/MF vs Hive), version, and internet exposure of management or print-related services.
  Unpatched or publicly reachable servers are high priority.
- For NG/MF parents, search the same `host.id` for `.class` file creation under `server\\lib` (for example `Udydn.class`,
  `Moo97.class`) and related artifacts under `server\\data\\content` (`*.cmd`, `*.out`).
- Inspect PaperCut logs for hex-encoded payloads, base64 command strings, Derby boot messages referencing
  `memory:...\\pwn`, `jdbc:derby:memory:pwn`, `ERROR No suitable driver found for jdbc:no:x`, or truncated/deleted logs.
- Correlate with inbound web or print-service requests around `@timestamp` (proxy, WAF, firewall).
- Pivot on `user.id` and `host.id` for follow-on credential access, persistence, or lateral movement within 48 hours.

### False positive analysis

- PaperCut upgrades, support tooling, or rare admin scripts might spawn expected helpers. Validate change windows,
  signed binaries, and command lines before exceptioning.
- Do not exclude on `pc-app.exe` or `pc-printjob-spooler.exe` alone; require a stable benign child path and command pattern.

### Response and remediation

- Isolate or restrict network access to the implicated PaperCut service immediately if public-facing.
- Preserve PaperCut logs, configuration, process trees from the parent binary, and any `.class`/`.cmd`/`.out` artifacts
  before upgrade or reboot.
- Apply PaperCut Emergency Patch Release 2 (or newer fixed builds) for NG/MF, including site/secondary servers; validate
  Hive component versions and vendor guidance for Hive-specific hosts.
- Hunt estate-wide for the same child-process and `.class` drop patterns; rotate credentials if compromise is confirmed.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [CrowdStrike](https://ela.st/crowdstrike-integration)
"""

references = [
    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
    "https://www.huntress.com/blog/papercut-actively-exploited",
]
risk_score = 73
rule_id = "1d0cf8ae-ed2c-4c74-bc01-462cfd928b64"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Use Case: Vulnerability",
    "Tactic: Initial Access",
    "Tactic: Execution",
    "Data Source: Elastic Defend",
    "Data Source: Elastic Endgame",
    "Data Source: Sysmon",
    "Data Source: Windows Security Event Logs",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
  (
    process.name : (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "powershell_ise.exe",
      "wscript.exe",
      "cscript.exe",
      "mshta.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "bitsadmin.exe",
      "certutil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "calc.exe",
      "mspaint.exe"
    ) or
    ?process.pe.original_file_name : (
      "Cmd.Exe",
      "PowerShell.EXE",
      "pwsh.dll",
      "powershell_ise.EXE",
      "wscript.exe",
      "cscript.exe",
      "MSHTA.EXE",
      "RUNDLL32.EXE",
      "REGSVR32.EXE",
      "bitsadmin.exe",
      "CertUtil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "CALC.EXE",
      "mspaint.exe"
    )
  )
'''

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.id",
    "user.name",
    "process.entity_id",
    "process.pid",
    "process.name",
    "process.executable",
    "process.command_line",
    "process.pe.original_file_name",
    "process.parent.name",
    "process.parent.executable",
    "process.parent.command_line",
]

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"

[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"