PaperCut MF/NG Exploitation Indicators
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
Sigma
