Sigma rule: PaperCut MF/NG Potential Exploitation

Rule

Title

PaperCut MF/NG Potential Exploitation

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)

Date

2023-04-20

Modified

2023-04-25

File

rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith: '\pc-app.exe'
    Image|endswith:
        - '\bash.exe'
        - '\calc.exe'
        - '\certutil.exe'
        - '\cmd.exe'
        - '\csc.exe'
        - '\cscript.exe'
        - '\dllhost.exe'
        - '\mshta.exe'
        - '\msiexec.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\scriptrunner.exe'
        - '\wmic.exe'
        - '\wscript.exe'
        - '\wsl.exe'
condition: selection

False positives (as the rule lists them)

• Legitimate administration activity

Tags

• attack.execution
• detection.emerging-threats

References

• https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
• https://github.com/huntresslabs/threat-intel/blob/3bad6b0fadfcca3ff5680923e74e39edd72f32da/2023/2023-04/20-PaperCut/win_susp_papercut_code_execution.yml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml