[New] PaperCut CVE-2026-82078 and CVE-2026-81578

Detects suspicious child process execution originating from PaperCut server components:

https://www.huntress.com/blog/papercut-actively-exploited

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

Author: Samirbous

rules/cross-platform/initial_access_papercut_java_class_file.toml

@@ -0,0 +1,141 @@
+[metadata]
+creation_date = "2026/08/28"
+integration = ["endpoint"]
+maturity = "production"
+updated_date = "2026/08/28"
+
+[rule]
+author = ["Elastic"]
+description = """
+Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active
+exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads
+into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes
+inside the PaperCut JVM / Application Server process.
+"""
+from = "now-9m"
+index = ["logs-endpoint.events.file-*"]
+language = "eql"
+license = "Elastic License v2"
+name = "Suspicious Java Class File Created in PaperCut Server Library"
+note = """## Triage and analysis
+
+### Investigating Suspicious Java Class File Created in PaperCut Server Library
+
+PaperCut NG/MF loads database/driver-related classes from the Application Server classpath. CVE-2026-82078 allows unsafe
+dynamic class loading when configuration can be manipulated (enabled by CVE-2026-81578 authentication bypass). Huntress
+recovered attacker `.class` files written under `server\\lib` (for example `Udydn.class`, `Moo97.class`) that decoded
+commands, wrote output under `server\\data\\content`, then deleted staging files and often `server.log`.
+
+#### Possible investigation steps
+
+- Inspect `file.path`, `file.name`, `file.size`, and writing `process.executable`/`process.name`. Unexpected short or
+  random `.class` names under `server/lib` are high confidence.
+- On the same host, look for companion artifacts under `server/data/content` (`.cmd`, `.out`) and for suspicious
+  `pc-app.exe` / Java child processes (shells, `whoami`, `tasklist`, `charmap.exe`).
+- Review PaperCut `server/logs` for hex-encoded blobs, base64 command strings, `jdbc:derby:memory:pwn`, Derby boot paths
+  containing `\\pwn`, or `ERROR No suitable driver found for jdbc:no:x`. Note missing/truncated `server.log` files.
+- Confirm whether a PaperCut upgrade or emergency patch was running at `@timestamp`; legitimate upgrades also write
+  many `.class` files under `server/lib`.
+- Scope other PaperCut servers for the same file names/paths and review internet exposure of the management interface.
+
+### False positive analysis
+
+- PaperCut installation, upgrade, and emergency patch operations legitimately create `.class` files under `server/lib`.
+  Correlate with change tickets, installer process names, and volume of writes before treating as malicious.
+- Exclude only tightly scoped upgrade processes/paths after validation; do not blanket-exclude the `server/lib` directory.
+
+### Response and remediation
+
+- Restrict public access to the PaperCut Application Server immediately.
+- Preserve `server/lib` `.class` files, `server/logs`, `server/data/content`, and process telemetry before cleanup or patch.
+- Remove unauthorized `.class` payloads after evidence collection; apply PaperCut Emergency Patch Release 2 (or newer).
+- Hunt for related child-process activity from `pc-app.exe` and rotate credentials if exploitation is confirmed.
+"""
+
+setup = """## Setup
+
+This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
+
+Setup instructions: https://ela.st/install-elastic-defend
+"""
+
+references = [
+    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
+    "https://www.huntress.com/blog/papercut-actively-exploited",
+]
+risk_score = 99
+rule_id = "a2d4508e-e9c2-41f6-9466-0c3aed8cc2c9"
+severity = "critical"
+tags = [
+    "Domain: Endpoint",
+    "OS: Windows",
+    "OS: Linux",
+    "OS: macOS",
+    "Use Case: Threat Detection",
+    "Use Case: Vulnerability",
+    "Tactic: Initial Access",
+    "Tactic: Execution",
+    "Data Source: Elastic Defend",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+file where host.os.type in ("windows", "linux", "macos") and
+  event.action in ("creation", "overwrite") and
+  file.extension : "class" and
+  file.path : (
+    "?:\\Program Files\\PaperCut*\\server\\lib\\*",
+    "?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
+    "/opt/papercut/server/lib/*",
+    "/usr/local/papercut/server/lib/*",
+    "/Applications/PaperCut*/server/lib/*"
+  )
+'''
+
+[rule.investigation_fields]
+field_names = [
+    "@timestamp",
+    "host.id",
+    "host.name",
+    "host.os.type",
+    "user.id",
+    "user.name",
+    "process.name",
+    "process.executable",
+    "file.path",
+    "file.name",
+    "file.size",
+]
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+
+[[rule.threat.technique]]
+id = "T1620"
+name = "Reflective Code Loading"
+reference = "https://attack.mitre.org/techniques/T1620/"
+
+[rule.threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"

rules/windows/initial_access_papercut_suspicious_child_process.toml

@@ -0,0 +1,227 @@
+[metadata]
+creation_date = "2026/08/28"
+integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
+maturity = "production"
+updated_date = "2026/08/28"
+
+[rule]
+author = ["Elastic"]
+description = """
+Detects suspicious child process execution originating from PaperCut server components, including the PaperCut NG/MF
+Application Server (pc-app.exe) and PaperCut Hive print job spooler (pc-printjob-spooler.exe). Active exploitation of
+CVE-2026-82078 and CVE-2026-81578 abuses unsafe dynamic class loading and an authentication bypass to achieve
+pre-authenticated remote code execution under pc-app.exe. Similar suspicious shell spawning has also been observed from
+PaperCut Hive's pc-printjob-spooler.exe (for example cmd.exe executing echo/test-style commands). Observed NG/MF
+in-the-wild activity includes discovery utilities such as whoami and tasklist; proof-of-concept exploitation has spawned
+unexpected Windows utilities such as charmap.exe as SYSTEM.
+"""
+from = "now-9m"
+index = [
+    "logs-endpoint.events.process-*",
+    "winlogbeat-*",
+    "logs-windows.sysmon_operational-*",
+    "logs-windows.forwarded*",
+    "logs-system.security*",
+    "endgame-*",
+    "logs-m365_defender.event-*",
+    "logs-sentinel_one_cloud_funnel.*",
+    "logs-crowdstrike.fdr*",
+]
+language = "eql"
+license = "Elastic License v2"
+name = "Suspicious Child Process of PaperCut Server Component"
+note = """## Triage and analysis
+
+### Investigating Suspicious Child Process of PaperCut Server Component
+
+PaperCut NG/MF Application Server (`pc-app.exe`) and PaperCut Hive components such as `pc-printjob-spooler.exe` should
+not routinely spawn interactive shells, download utilities, or discovery tools. CVE-2026-81578 (authentication bypass)
+chained with CVE-2026-82078 (unsafe dynamic class loading) enables pre-authentication remote code execution under
+`pc-app.exe`. Huntress observed short exploitation windows with base64-encoded commands such as `whoami & ver` and
+`whoami & ver & tasklist`, and reproduced RCE that spawned `charmap.exe` as SYSTEM under `pc-app.exe`. Separate telemetry
+has also shown `pc-printjob-spooler.exe` under `Program Files\\PaperCut Hive\\` launching `cmd.exe` with attacker- or
+test-controlled command lines.
+
+#### Possible investigation steps
+
+- Review the parent-child chain: `process.parent.name`/`process.parent.executable` (for example `pc-app.exe` or
+  `pc-printjob-spooler.exe` under `PaperCut*` install paths); inspect child `process.name`, `process.executable`, and
+  `process.command_line` for shells, LOLBins, discovery tools, or trivial probing commands such as `echo test`.
+- Confirm PaperCut product (NG/MF vs Hive), version, and internet exposure of management or print-related services.
+  Unpatched or publicly reachable servers are high priority.
+- For NG/MF parents, search the same `host.id` for `.class` file creation under `server\\lib` (for example `Udydn.class`,
+  `Moo97.class`) and related artifacts under `server\\data\\content` (`*.cmd`, `*.out`).
+- Inspect PaperCut logs for hex-encoded payloads, base64 command strings, Derby boot messages referencing
+  `memory:...\\pwn`, `jdbc:derby:memory:pwn`, `ERROR No suitable driver found for jdbc:no:x`, or truncated/deleted logs.
+- Correlate with inbound web or print-service requests around `@timestamp` (proxy, WAF, firewall).
+- Pivot on `user.id` and `host.id` for follow-on credential access, persistence, or lateral movement within 48 hours.
+
+### False positive analysis
+
+- PaperCut upgrades, support tooling, or rare admin scripts might spawn expected helpers. Validate change windows,
+  signed binaries, and command lines before exceptioning.
+- Do not exclude on `pc-app.exe` or `pc-printjob-spooler.exe` alone; require a stable benign child path and command pattern.
+
+### Response and remediation
+
+- Isolate or restrict network access to the implicated PaperCut service immediately if public-facing.
+- Preserve PaperCut logs, configuration, process trees from the parent binary, and any `.class`/`.cmd`/`.out` artifacts
+  before upgrade or reboot.
+- Apply PaperCut Emergency Patch Release 2 (or newer fixed builds) for NG/MF, including site/secondary servers; validate
+  Hive component versions and vendor guidance for Hive-specific hosts.
+- Hunt estate-wide for the same child-process and `.class` drop patterns; rotate credentials if compromise is confirmed.
+"""
+
+setup = """## Setup
+
+This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
+
+Setup instructions: https://ela.st/install-elastic-defend
+
+### Additional data sources
+
+This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
+
+- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
+- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
+- [Microsoft Defender XDR](https://ela.st/m365-defender)
+- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
+- [CrowdStrike](https://ela.st/crowdstrike-integration)
+"""
+
+references = [
+    "https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/",
+    "https://www.huntress.com/blog/papercut-actively-exploited",
+]
+risk_score = 73
+rule_id = "1d0cf8ae-ed2c-4c74-bc01-462cfd928b64"
+severity = "high"
+tags = [
+    "Domain: Endpoint",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Use Case: Vulnerability",
+    "Tactic: Initial Access",
+    "Tactic: Execution",
+    "Data Source: Elastic Defend",
+    "Data Source: Elastic Endgame",
+    "Data Source: Sysmon",
+    "Data Source: Windows Security Event Logs",
+    "Data Source: Microsoft Defender XDR",
+    "Data Source: SentinelOne",
+    "Data Source: Crowdstrike",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "eql"
+
+query = '''
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
+  (
+    process.name : (
+      "cmd.exe",
+      "powershell.exe",
+      "pwsh.exe",
+      "powershell_ise.exe",
+      "wscript.exe",
+      "cscript.exe",
+      "mshta.exe",
+      "rundll32.exe",
+      "regsvr32.exe",
+      "bitsadmin.exe",
+      "certutil.exe",
+      "curl.exe",
+      "wget.exe",
+      "net.exe",
+      "net1.exe",
+      "whoami.exe",
+      "tasklist.exe",
+      "ipconfig.exe",
+      "nltest.exe",
+      "systeminfo.exe",
+      "charmap.exe",
+      "calc.exe",
+      "mspaint.exe"
+    ) or
+    ?process.pe.original_file_name : (
+      "Cmd.Exe",
+      "PowerShell.EXE",
+      "pwsh.dll",
+      "powershell_ise.EXE",
+      "wscript.exe",
+      "cscript.exe",
+      "MSHTA.EXE",
+      "RUNDLL32.EXE",
+      "REGSVR32.EXE",
+      "bitsadmin.exe",
+      "CertUtil.exe",
+      "curl.exe",
+      "wget.exe",
+      "net.exe",
+      "net1.exe",
+      "whoami.exe",
+      "tasklist.exe",
+      "ipconfig.exe",
+      "nltest.exe",
+      "systeminfo.exe",
+      "charmap.exe",
+      "CALC.EXE",
+      "mspaint.exe"
+    )
+  )
+'''
+
+[rule.investigation_fields]
+field_names = [
+    "@timestamp",
+    "host.id",
+    "host.name",
+    "user.id",
+    "user.name",
+    "process.entity_id",
+    "process.pid",
+    "process.name",
+    "process.executable",
+    "process.command_line",
+    "process.pe.original_file_name",
+    "process.parent.name",
+    "process.parent.executable",
+    "process.parent.command_line",
+]
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1190"
+name = "Exploit Public-Facing Application"
+reference = "https://attack.mitre.org/techniques/T1190/"
+
+[rule.threat.tactic]
+id = "TA0001"
+name = "Initial Access"
+reference = "https://attack.mitre.org/tactics/TA0001/"
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+
+[[rule.threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+
+[[rule.threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+[[rule.threat.technique.subtechnique]]
+id = "T1059.003"
+name = "Windows Command Shell"
+reference = "https://attack.mitre.org/techniques/T1059/003/"
+
+[rule.threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"