---
title: Suspicious Java Class File Created in PaperCut Server Library
description: Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active exploitation of CVE-2026-82078 (chained...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/cross-platform/initial_access_papercut_java_class_file
products:
  - Elastic Security
---

# Suspicious Java Class File Created in PaperCut Server Library
Detects creation of Java .class files within the PaperCut NG/MF Application Server library directory. During active
exploitation of CVE-2026-82078 (chained with CVE-2026-81578), attackers deliver hex-encoded malicious .class payloads
into the PaperCut server/lib path (observed examples include Udydn.class and Moo97.class) so arbitrary bytecode executes
inside the PaperCut JVM / Application Server process.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.file-*

**Rule Severity**: critical
**Risk Score**: 99
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/)](https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/)
- [[https://www.huntress.com/blog/papercut-actively-exploited](https://www.huntress.com/blog/papercut-actively-exploited)](https://www.huntress.com/blog/papercut-actively-exploited)

**Tags**:
- Domain: Endpoint
- OS: Windows
- OS: Linux
- OS: macOS
- Use Case: Threat Detection
- Use Case: Vulnerability
- Tactic: Initial Access
- Tactic: Execution
- Tactic: Defense Evasion
- Data Source: Elastic Defend
- Resources: Investigation Guide
- Rule Type: Event Correlation (EQL)
- Platform: Windows
- Platform: Linux
- Platform: macOS
- Vuln: CVE-2026-81578
- Vuln: CVE-2026-82078

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
Setup instructions: [https://ela.st/install-elastic-defend](https://ela.st/install-elastic-defend)

## Investigation guide


## Triage and analysis


### Investigating Suspicious Java Class File Created in PaperCut Server Library

PaperCut NG/MF loads database/driver-related classes from the Application Server classpath. CVE-2026-82078 allows unsafe
dynamic class loading when configuration can be manipulated (enabled by CVE-2026-81578 authentication bypass). Huntress
recovered attacker `.class` files written under `server\lib` (for example `Udydn.class`, `Moo97.class`) that decoded
commands, wrote output under `server\data\content`, then deleted staging files and often `server.log`.

#### Possible investigation steps

- Inspect `file.path`, `file.name`, `file.size`, and writing `process.executable`/`process.name`. Unexpected short or
  random `.class` names under `server/lib` are high confidence.
- On the same host, look for companion artifacts under `server/data/content` (`.cmd`, `.out`) and for suspicious
  `pc-app.exe` / Java child processes (shells, `whoami`, `tasklist`, `charmap.exe`).
- Review PaperCut `server/logs` for hex-encoded blobs, base64 command strings, `jdbc:derby:memory:pwn`, Derby boot paths
  containing `\pwn`, or `ERROR No suitable driver found for jdbc:no:x`. Note missing/truncated `server.log` files.
- Confirm whether a PaperCut upgrade or emergency patch was running at `@timestamp`; legitimate upgrades also write
  many `.class` files under `server/lib`.
- Scope other PaperCut servers for the same file names/paths and review internet exposure of the management interface.


### False positive analysis

- PaperCut installation, upgrade, and emergency patch operations legitimately create `.class` files under `server/lib`.
  Correlate with change tickets, installer process names, and volume of writes before treating as malicious.
- Exclude only tightly scoped upgrade processes/paths after validation; do not blanket-exclude the `server/lib` directory.


### Response and remediation

- Restrict public access to the PaperCut Application Server immediately.
- Preserve `server/lib` `.class` files, `server/logs`, `server/data/content`, and process telemetry before cleanup or patch.
- Remove unauthorized `.class` payloads after evidence collection; apply PaperCut Emergency Patch Release 2 (or newer).
- Hunt for related child-process activity from `pc-app.exe` and rotate credentials if exploitation is confirmed.


## Rule Query

```eql
file where host.os.type in ("windows", "linux", "macos") and
  event.action in ("creation", "overwrite") and
  file.extension : "class" and
  file.path : (
    "?:\\Program Files\\PaperCut*\\server\\lib\\*",
    "?:\\Program Files (x86)\\PaperCut*\\server\\lib\\*",
    "/opt/papercut/server/lib/*",
    "/usr/local/papercut/server/lib/*",
    "/Applications/PaperCut*/server/lib/*"
  )
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
  - Id: TA0001
  - Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)
- Technique:
  - Name: Exploit Public-Facing Application
  - Id: T1190
  - Reference URL: [[https://attack.mitre.org/techniques/T1190/](https://attack.mitre.org/techniques/T1190/)](https://attack.mitre.org/techniques/T1190/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Command and Scripting Interpreter
  - Id: T1059
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/)](https://attack.mitre.org/techniques/T1059/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Defense Evasion
  - Id: TA0005
  - Reference URL: [[https://attack.mitre.org/tactics/TA0005/](https://attack.mitre.org/tactics/TA0005/)](https://attack.mitre.org/tactics/TA0005/)
- Technique:
  - Name: Reflective Code Loading
  - Id: T1620
  - Reference URL: [[https://attack.mitre.org/techniques/T1620/](https://attack.mitre.org/techniques/T1620/)](https://attack.mitre.org/techniques/T1620/)