PaperCut NG/MF Pre-Authentication RCE

Looks for: PaperCut server process inventory. Accomplishes: covers papercut application server inventory while retaining host and process context for analyst verification.

Trace: H01 · A01

// HUNT: PaperCut Application Server inventory
// HYPOTHESIS: H01
// USE: inventory
// MITRE: N/A — inventory
// CONF: low
// FP: medium
// COST: low
// TIMEFRAME: 30d — retrospective window for the August 2026 active exploitation
// REQUIRES: Falcon endpoint event repository; documented fields shown in the query
// FALSE POSITIVES: Approved PaperCut administration, patching, testing, or managed remote-support deployment
// TUNING: Exclude only exact approved PaperCut administrative workflows or managed-tool installations after a measured benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| (FileName="pc-app.exe" OR FileName="pc-app" OR ImageFileName="*PaperCut MF*pc-app*" OR ImageFileName="*PaperCut NG*pc-app*")
| groupBy([aid, ComputerName, FileName, ImageFileName, SHA256HashData], function=[count(as=Executions), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=1000)
| sort(LastSeen, order=desc, limit=1000)

Looks for: pc-app child shell and discovery execution. Accomplishes: covers papercut server spawning discovery or shell utilities while retaining host and process context for analyst verification.

Trace: H02 · A02

// HUNT: PaperCut server spawning discovery or shell utilities
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1059.003, T1082, T1057
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 14d — retrospective window for the August 2026 active exploitation
// REQUIRES: Falcon endpoint event repository; documented fields shown in the query
// FALSE POSITIVES: Approved PaperCut administration, patching, testing, or managed remote-support deployment
// TUNING: Exclude only exact approved PaperCut administrative workflows or managed-tool installations after a measured benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^pc-app(\.exe)?$/i
| FileName=/^(cmd|powershell|pwsh|whoami|tasklist|nltest|quser|charmap|sh|bash)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, ParentProcessId, TargetProcessId], limit=1000)

Looks for: PaperCut server/lib class-file writes. Accomplishes: covers five-character java class payloads in papercut paths while retaining host and process context for analyst verification.

Trace: H03 · A03

// HUNT: Five-character Java class payloads in PaperCut paths
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1105, T1129
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — retrospective window for the August 2026 active exploitation
// REQUIRES: Falcon endpoint event repository; documented fields shown in the query
// FALSE POSITIVES: Approved PaperCut administration, patching, testing, or managed remote-support deployment
// TUNING: Exclude only exact approved PaperCut administrative workflows or managed-tool installations after a measured benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=/^(JarFileWritten|NewExecutableWritten|PeFileWritten)$/
| FileName=/^[A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9]\.class$/i
| (FilePath="*PaperCut MF*server*lib*" OR FilePath="*PaperCut NG*server*lib*")
| table([@timestamp, aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId], limit=1000)

Looks for: PaperCut transient exploit artifacts. Accomplishes: covers observed papercut transient class, command, and output artifacts while retaining host and process context for analyst verification.

Trace: H04 · A04

// HUNT: Observed PaperCut transient class, command, and output artifacts
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1070.004
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — retrospective window for the August 2026 active exploitation
// REQUIRES: Falcon endpoint event repository; documented fields shown in the query
// FALSE POSITIVES: Approved PaperCut administration, patching, testing, or managed remote-support deployment
// TUNING: Exclude only exact approved PaperCut administrative workflows or managed-tool installations after a measured benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=/^(JarFileWritten|NewExecutableWritten|PeFileWritten)$/
| ((FileName="Udydn.class" OR FileName="Moo97.class") AND FilePath="*server*lib*" OR (FileName="Udydn.cmd" OR FileName="Udydn.out") AND FilePath="*server*data*content*")
| table([@timestamp, aid, ComputerName, FileName, FilePath, ContextBaseFileName, ContextProcessId], limit=1000)

Looks for: pc-app PowerShell or downloader retrieval. Accomplishes: covers papercut server retrieving remote tools while retaining host and process context for analyst verification.

Trace: H05 · A05

// HUNT: PaperCut server retrieving remote tools
// HYPOTHESIS: H05
// USE: alert-candidate
// MITRE: T1105
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 14d — retrospective window for the August 2026 active exploitation
// REQUIRES: Falcon endpoint event repository; documented fields shown in the query
// FALSE POSITIVES: Approved PaperCut administration, patching, testing, or managed remote-support deployment
// TUNING: Exclude only exact approved PaperCut administrative workflows or managed-tool installations after a measured benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| ParentBaseFileName=/^pc-app(\.exe)?$/i
| (CommandLine=/Invoke-WebRequest|sendit[.]sh|ace[.]exe|AnyDesk[.]exe/i OR FileName=/^(curl|wget)(\.exe)?$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentProcessId, TargetProcessId], limit=1000)

Looks for: SimpleHelp service persistence. Accomplishes: covers simplehelp remote access service installation while retaining host and process context for analyst verification.

Trace: H06 · A06

// HUNT: SimpleHelp Remote Access Service installation
// HYPOTHESIS: H06
// USE: alert-candidate
// MITRE: T1543.003
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — retrospective window for the August 2026 active exploitation
// REQUIRES: Falcon endpoint event repository; documented fields shown in the query
// FALSE POSITIVES: Approved PaperCut administration, patching, testing, or managed remote-support deployment
// TUNING: Exclude only exact approved PaperCut administrative workflows or managed-tool installations after a measured benign baseline
// VALIDATION: STATIC-ONLY
#event_simpleName=ProcessRollup2
| (FileName="SimpleService.exe" OR ImageFileName="*JWrapper-Remote Access*SimpleService.exe" OR CommandLine="*Remote Access Service*SimpleService.exe*")
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, TargetProcessId], limit=1000)