Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
29 detections
Filters
Last updated
All Time
Detection languages
9
8
4
3
3
Contributors
10
9
7
2
1
Categories
21
11
9
9
8
Platforms
17
11
5
1
Products / Services
9
9
8
4
4
MITRE Techniques
20
7
6
5
4
CVEs
71
71
64
58
49
29
IDS Classtypes
7
1
1
IDS Protocols
9
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects anomalous child process execution originating from PaperCut application processes (pc-app.exe) or associated Java processes. This is indicative of post-exploitation activity following an RCE vulnerability where the application server is leveraged to spawn command interpreters, discovery utilities, or ingress tools.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Detects unauthenticated HTTP POST requests to the PaperCut web management interface that attempt to modify server configuration settings. This behavior is consistent with exploitation attempts targeting vulnerabilities like CVE-2026-81578, which may allow for unauthorized pre-authentication remote code execution.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
The detection assumes that a dedicated service account is used to run the PaperCut service.
This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Page 2 of 2