Windows: Suspicious child processes spawned by pc-app.exe (PaperCut MF/NG potential exploitation)
Alert on pc-app.exe spawning common command or scripting utilities on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea) (SigmaHQ), DRL 1.1
- Published
- 2023-04-20
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation events where pc-app.exe spawns a child process from a common scripting, execution, and living-off-the-land tool set (for example PowerShell, cmd.exe, mshta.exe, certutil.exe, and wmic.exe). Such parent-child relationships can indicate attempted exploitation or post-exploitation activity against a PaperCut MF/NG component running as pc-app.exe. It relies on process_creation telemetry with parent and image path fields that end with pc-app.exe and the matched child executable names.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
- github.comhttps://github.com/huntresslabs/threat-intel/blob/3bad6b0fadfcca3ff5680923e74e39edd72f32da/2023/2023-04/20-PaperCut/win_susp_papercut_code_execution.yml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious child processes spawned by pc-app.exe (PaperCut MF/NG potential exploitation)"
id: 233c5472-310e-4952-9def-fea41cf95346
status: test
description: This rule identifies Windows process creation events where pc-app.exe spawns a child process from a common scripting, execution, and living-off-the-land tool set (for example PowerShell, cmd.exe, mshta.exe, certutil.exe, and wmic.exe). Such parent-child relationships can indicate attempted exploitation or post-exploitation activity against a PaperCut MF/NG component running as pc-app.exe. It relies on process_creation telemetry with parent and image path fields that end with pc-app.exe and the matched child executable names.
references:
- https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
- https://github.com/huntresslabs/threat-intel/blob/3bad6b0fadfcca3ff5680923e74e39edd72f32da/2023/2023-04/20-PaperCut/win_susp_papercut_code_execution.yml
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea), Huntrule Team
date: 2023-04-20
modified: 2023-04-25
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \pc-app.exe
Image|endswith:
- \bash.exe
- \calc.exe
- \certutil.exe
- \cmd.exe
- \csc.exe
- \cscript.exe
- \dllhost.exe
- \mshta.exe
- \msiexec.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \scriptrunner.exe
- \wmic.exe
- \wscript.exe
- \wsl.exe
condition: selection
falsepositives:
- Legitimate administration activity
level: high
license: DRL-1.1
related:
- id: 0934ac71-a331-4e98-a034-d49c491fbbcb
type: derived