Elastic critical stable eql

Suspicious Java Class File Created in PaperCut Server Library

Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes inside the PaperCut JVM / Application Server process.

View Source

Detection Logic

file where host.os.type in ("windows", "linux", "macos") and
  event.action in ("creation", "overwrite") and
  file.extension : "class" and
  file.path : (
    "?:\\Program Files\\PaperCut*\\server\\lib\\*",
    "?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
    "/opt/papercut/server/lib/*",
    "/usr/local/papercut/server/lib/*",
    "/Applications/PaperCut*/server/lib/*"
  )

Field Validations

Loading…

Comments (0)

Loading comments...