Windows Suspicious Child Processes Spawned by pc-app.exe

title: Windows Suspicious Child Processes Spawned by pc-app.exe
id: 233c5472-310e-4952-9def-fea41cf95346
status: test
description: This rule flags process creation events where the parent process is pc-app.exe and the child process image matches common script, command, or execution tools (e.g., cmd.exe, PowerShell, certutil, mshta). Such behavior is significant because it can indicate code execution following exploitation attempts against the PaperCut MF/NG application. It relies on Windows process creation telemetry, including parent and image paths/filenames.
references:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
  - https://github.com/huntresslabs/threat-intel/blob/3bad6b0fadfcca3ff5680923e74e39edd72f32da/2023/2023-04/20-PaperCut/win_susp_papercut_code_execution.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea), Huntrule Team
date: 2023-04-20
modified: 2023-04-25
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \pc-app.exe
    Image|endswith:
      - \bash.exe
      - \calc.exe
      - \certutil.exe
      - \cmd.exe
      - \csc.exe
      - \cscript.exe
      - \dllhost.exe
      - \mshta.exe
      - \msiexec.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \scriptrunner.exe
      - \wmic.exe
      - \wscript.exe
      - \wsl.exe
  condition: selection
falsepositives:
  - Legitimate administration activity
level: high
license: DRL-1.1
related:
  - id: 0934ac71-a331-4e98-a034-d49c491fbbcb
    type: derived