Suspicious Child Process of PaperCut Server Component
Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned unexpected Windows utilities such as charmap.exe as SYSTEM.
Detection Logic
process where host.os.type == "windows" and event.type == "start" and
process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
(
process.name : (
"cmd.exe",
"powershell.exe",
"pwsh.exe",
"powershell_ise.exe",
"wscript.exe",
"cscript.exe",
"mshta.exe",
"rundll32.exe",
"regsvr32.exe",
"bitsadmin.exe",
"certutil.exe",
"curl.exe",
"wget.exe",
"net.exe",
"net1.exe",
"whoami.exe",
"tasklist.exe",
"ipconfig.exe",
"nltest.exe",
"systeminfo.exe",
"charmap.exe",
"calc.exe",
"mspaint.exe"
) or
?process.pe.original_file_name : (
"Cmd.Exe",
"PowerShell.EXE",
"pwsh.dll",
"powershell_ise.EXE",
"wscript.exe",
"cscript.exe",
"MSHTA.EXE",
"RUNDLL32.EXE",
"REGSVR32.EXE",
"bitsadmin.exe",
"CertUtil.exe",
"curl.exe",
"wget.exe",
"net.exe",
"net1.exe",
"whoami.exe",
"tasklist.exe",
"ipconfig.exe",
"nltest.exe",
"systeminfo.exe",
"charmap.exe",
"CALC.EXE",
"mspaint.exe"
)
)Field Validations
Loading…
Comments (0)
Loading comments...