Detects creation or overwrite of Java .class files within the PaperCut NG/MF Application Server library directory (server/lib) to catch exploitation of CVE-2026-82078 chained with CVE-2026-81578. Adversaries drop hex-encoded payloads (examples include Udydn.class and Moo97.class) into PaperCut’s server/lib path to achieve arbitrary bytecode execution inside the PaperCut JVM. The rule watches cross-platform PaperCut installations (Windows, Linux, macOS) and triggers on file creation or overwrite events for .class files under common install paths: ?:\Program Files\PaperCut*\server\lib\*, ?:\Program Files (x86)\PaperCut*\server\lib\*, /opt/papercut/server/lib/*, /usr/local/papercut/server/lib/*, and /Applications/PaperCut*/server/lib/*. It maps to MITRE ATT&CK techniques: T1190 Exploit Public-Facing Application (Initial Access), T1059 Command and Scripting Interpreter (Execution), and T1620 Reflective Code Loading (Defense Evasion). Investigative indicators include hex or base64 encoded strings in PaperCut logs, companion artifacts under server/data/content, and suspicious processes like pc-app.exe or Java child processes performing remote commands. False positives may arise from legitimate PaperCut upgrades or patches that also write .class files; correlate with change tickets and installer/process names. Remediation actions include restricting access to the PaperCut management interface, preserving evidence (server/lib .class files, server/logs, server/data/content), removing unauthorized payloads, applying the emergency PaperCut patch, and rotating credentials if exploitation is confirmed.