PaperCut server Java process spawning local admin creation and AD enumeration
Detects post-exploitation behavior where a PaperCut server Java process spawns local account creation or administrator reset followed closely by Active Directory enumeration on the same host, indicating potential post-RCE meterpreter activity.
Microsoft Sentinel (KQL)
