Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
8
7
4
3
2
Contributors
9
7
7
1
1
Categories
17
8
8
8
7
Platforms
15
9
3
Products / Services
8
8
7
4
3
MITRE Techniques
16
7
6
5
4
CVEs
71
71
64
58
49
25
IDS Classtypes
7
1
IDS Protocols
8
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
The detection assumes that a dedicated service account is used to run the PaperCut service.
This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
This detection identifies processes launched by the dedicated PaperCut service account that are outside of the expected PaperCut installation directory (C:\Program Files\PaperCut MF\server\bin\win). It excludes a small number of benign processes (conhost.exe and msg.exe) that may be launched during normal operations.
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Page 2 of 2