[New] PaperCut CVE-2026-82078 and CVE-2026-81578

[Samirbous]

Detects suspicious child process execution originating from PaperCut server components:

https://www.huntress.com/blog/papercut-actively-exploited

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Suspicious Child Process of PaperCut Server Component (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Suspicious Java Class File Created in PaperCut Server Library (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[Copilot]

Pull request overview

Adds new Elastic detection rules to identify likely exploitation activity associated with PaperCut NG/MF / Hive, focusing on CVE-2026-82078 and CVE-2026-81578 behaviors (suspicious child process spawning and malicious .class drops).

Changes:

• Adds a Windows EQL rule detecting suspicious child processes spawned by PaperCut server components (pc-app.exe, pc-printjob-spooler.exe).
• Adds a cross-platform (Windows/Linux/macOS) EQL file rule detecting Java .class creation under PaperCut NG/MF server/lib, with investigation guidance for correlated artifacts.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
rules/windows/initial_access_papercut_suspicious_child_process.toml	New Windows EQL detection for suspicious PaperCut child-process execution plus investigation guide.
rules/cross-platform/initial_access_papercut_java_class_file.toml	New cross-platform EQL file-write detection for suspicious PaperCut server/lib .class payload drops plus investigation guide.

Suppressed comments (1)

rules/cross-platform/initial_access_papercut_java_class_file.toml:89

• The file-event predicate uses event.action in ("creation", "overwrite") and file.extension : "class". Most file rules in this repo key off event.type in ("creation", "change"), and == is a faster/clearer exact match for file.extension. Also, using like for Linux/macOS paths avoids the more expensive case-insensitive : operator on case-sensitive filesystems.

file where host.os.type in ("windows", "linux", "macos") and
  event.action in ("creation", "overwrite") and
  file.extension : "class" and
  file.path : (
    "?:\\Program Files\\PaperCut*\\server\\lib\\*",

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Suspicious Child Process of PaperCut Server Component (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Suspicious Java Class File Created in PaperCut Server Library (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta

[elastic-vault-github-plugin-prod]

⛔️ Test failed

Results

• ❌ Suspicious Child Process of PaperCut Server Component (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta
• ❌ Suspicious Java Class File Created in PaperCut Server Library (eql)
  • coverage_issue: no_rta
  • stack_validation_failed: no_rta