win_susp_papercut_code_execution.yml

title: PaperCut MF/NG Vulnerability
authors: Huntress DE&TH Team
description: Detects suspicious code execution from vulnerable PaperCut versions MF and NG
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: "\\pc-app.exe"
    Image|endswith: 
      - "\\cmd.exe"
      - "\\powershell.exe"
  condition: selection
level: high
falsepositives:
    - Expected admin activity