Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Suspicious Child Process of PaperCut Server Component

Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned unexpected Windows utilities such as charmap.exe as SYSTEM.

ATT&CK coverage

Outside the enterprise matrix

Detection requirements

Log source category: event_index

What the source says

References

Tagged by the source as

Data Source: CrowdstrikeData Source: Elastic DefendData Source: Elastic EndgameData Source: Microsoft Defender XDRData Source: SentinelOneData Source: SysmonData Source: Windows Security Event LogsDomain: EndpointOS: WindowsResources: Investigation GuideTactic: ExecutionTactic: Initial AccessUse Case: Threat DetectionUse Case: Vulnerability

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.