PaperCut Server Process Spawning Shell or Discovery Tool (CVE-2026-81578/82078)
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Microsoft Sentinel (KQL)
