Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
8
7
4
3
2
Contributors
9
7
7
1
1
Categories
17
8
8
8
7
Platforms
15
9
3
Products / Services
8
8
7
4
3
MITRE Techniques
16
7
6
5
4
CVEs
71
71
64
58
49
25
IDS Classtypes
7
1
IDS Protocols
8
Detects an exploitation attempt against PaperCut MF software leveraging SQL injection to deliver a Java bytecode loader (identified by the 'cafebabe' magic bytes) via a POST request.
Detects outbound HTTP requests to known Alibaba OSS buckets hosting malicious AdaptixC2 payloads. This is associated with exploitation attempts against PaperCut MF software (referencing CVE-2026-82078 and CVE-2026-81578).
Detects incoming HTTP traffic containing a custom 'X-Quad' header, which is indicative of exploitation attempts targeting PaperCut MF vulnerabilities (CVE-2026-82078/CVE-2026-81578). This header is associated with the deployment or interaction with a Java-based web shell to establish unauthorized access.
Detects the deletion, truncation, or modification of critical PaperCut server logs and application files (server.log, pcxboot_l.txt, .bin files). This activity is associated with attempts to conceal exploitation of PaperCut vulnerabilities (e.g., CVE-2026-82078/81578) by clearing logs or tampering with binaries, typically executed by the PaperCut application processes themselves (pc-app.exe or Java runtime).
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
This rule monitors for suspicious process execution (e.g., cmd, powershell) spawned from PaperCut service processes (pc-app.exe, tomcat.exe) followed by a Domain Admin group membership change on the same device within a 30-minute window. This behavior is indicative of privilege escalation attempts following the exploitation of PaperCut vulnerabilities (CVE-2026-81578/CVE-2026-82078).
This rule detects potentially malicious child processes (cmd.exe or powershell.exe) spawned by PaperCut application processes (pc-app.exe, PCClient.exe, or java.exe), which may indicate exploitation attempts such as RCE following an authentication bypass.
Detects instances where the PaperCut application server process (pc-app.exe) or its underlying Java processes (javaw.exe or java.exe) spawn command-line interpreters such as cmd.exe or powershell.exe. This behavior is indicative of potential post-exploitation activity, specifically Remote Code Execution (RCE) via vulnerabilities targeting PaperCut servers.
Detects unauthenticated access attempts or requests originating from system/service accounts targeting the PaperCut NG/MF administrative interface, which may indicate exploitation of authentication bypass vulnerabilities (e.g., CVE-2026-81578).
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
This rule detects potential exploitation attempts against PaperCut servers by identifying high-frequency, consistent-interval network requests directed at PaperCut-specific URI patterns and ports, or associated with known vulnerability identifiers (CVE-2026-81578, CVE-2026-82078). The rule employs statistical analysis to identify potential automated scanning or exploitation activity, filtering out known geographic regions associated with lower-risk or irrelevant traffic.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects suspicious child processes (cmd.exe, powershell.exe, java.exe) spawned by the PaperCut NG/MF server processes (pc-app.exe or java.exe), which is indicative of potential post-exploitation activity following remote code execution.
Detects high-volume, sequential HTTP requests directed at sensitive PaperCut NG/MF web interfaces from a single source IP address within a one-hour window. The high frequency of unique target access suggests automated scanning or exploitation attempts (consistent with CVE-2026-81578/CVE-2026-82078) typical of AI-driven or scripted attack campaigns.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects anomalous child process execution originating from PaperCut application processes (pc-app.exe) or associated Java processes. This is indicative of post-exploitation activity following an RCE vulnerability where the application server is leveraged to spawn command interpreters, discovery utilities, or ingress tools.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Page 1 of 2