PaperCut Java server spawning shell and dropping .class or custom/web output file
Detects post-exploitation activity targeting PaperCut servers, including shells spawned by the PaperCut Java process or the creation of malicious files (such as .class files in lib/ or .txt webshells in custom/web/) by the Java application.
Microsoft Sentinel (KQL)
