PaperCut Java process spawning local admin creation and AD enumeration

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•3

Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.