« Suspicious Inter-Process Communication via Outlook Suspicious JavaScript Execution via Deno »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

Suspicious Java Class File Created in PaperCut Server Library

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Suspicious Java Class File Created in PaperCut Server Library

edit

Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes inside the PaperCut JVM / Application Server process.

Rule type: eql

Rule indices:

  • logs-endpoint.events.file-*

Severity: critical

Risk score: 99

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • OS: Linux
  • OS: macOS
  • Use Case: Threat Detection
  • Use Case: Vulnerability
  • Tactic: Initial Access
  • Tactic: Execution
  • Tactic: Defense Evasion
  • Data Source: Elastic Defend
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Suspicious Java Class File Created in PaperCut Server Library

PaperCut NG/MF loads database/driver-related classes from the Application Server classpath. CVE-2026-82078 allows unsafe dynamic class loading when configuration can be manipulated (enabled by CVE-2026-81578 authentication bypass). Huntress recovered attacker .class files written under server\lib (for example Udydn.class, Moo97.class) that decoded commands, wrote output under server\data\content, then deleted staging files and often server.log.

Possible investigation steps

  • Inspect file.path, file.name, file.size, and writing process.executable/process.name. Unexpected short or random .class names under server/lib are high confidence.
  • On the same host, look for companion artifacts under server/data/content (.cmd, .out) and for suspicious pc-app.exe / Java child processes (shells, whoami, tasklist, charmap.exe).
  • Review PaperCut server/logs for hex-encoded blobs, base64 command strings, jdbc:derby:memory:pwn, Derby boot paths containing \pwn, or ERROR No suitable driver found for jdbc:no:x. Note missing/truncated server.log files.
  • Confirm whether a PaperCut upgrade or emergency patch was running at @timestamp; legitimate upgrades also write many .class files under server/lib.
  • Scope other PaperCut servers for the same file names/paths and review internet exposure of the management interface.

False positive analysis

  • PaperCut installation, upgrade, and emergency patch operations legitimately create .class files under server/lib. Correlate with change tickets, installer process names, and volume of writes before treating as malicious.
  • Exclude only tightly scoped upgrade processes/paths after validation; do not blanket-exclude the server/lib directory.

Response and remediation

  • Restrict public access to the PaperCut Application Server immediately.
  • Preserve server/lib .class files, server/logs, server/data/content, and process telemetry before cleanup or patch.
  • Remove unauthorized .class payloads after evidence collection; apply PaperCut Emergency Patch Release 2 (or newer).
  • Hunt for related child-process activity from pc-app.exe and rotate credentials if exploitation is confirmed.

Setup

edit

Setup

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Rule query

edit
file where host.os.type in ("windows", "linux", "macos") and
  event.action in ("creation", "overwrite") and
  file.extension : "class" and
  file.path : (
    "?:\\Program Files\\PaperCut*\\server\\lib\\*",
    "?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
    "/opt/papercut/server/lib/*",
    "/usr/local/papercut/server/lib/*",
    "/Applications/PaperCut*/server/lib/*"
  )

Framework: MITRE ATT&CKTM

« Suspicious Inter-Process Communication via Outlook Suspicious JavaScript Execution via Deno »