Detection of Unusual Process Execution by PaperCut Service Account
The detection assumes that a dedicated service account is used to run the PaperCut service. This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
Microsoft Sentinel (KQL)
