PaperCut NG/MF server process spawning shell or credential-theft tooling
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Microsoft Sentinel (KQL)
