PaperCut MF/NG Potential Exploitation via Suspicious Child Processes

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•1•0•21

Detects suspicious child processes spawned by 'pc-app.exe', which is the main application executable for PaperCut MF/NG. The presence of common system utilities and scripting interpreters as child processes of 'pc-app.exe' can indicate successful exploitation of a vulnerability within PaperCut, potentially leading to arbitrary code execution.