Detects suspicious child process activity originating from PaperCut server components, specifically the PaperCut NG/MF Application Server (pc-app.exe) and PaperCut Hive’s pc-printjob-spooler.exe. The rule targets exploitation chains tied to CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe dynamic class loading) that can enable pre-authenticated remote code execution under pc-app.exe. It flags scenarios where these parent processes spawn interactive shells or LOLBins, including cmd.exe, PowerShell variants, wscript/cscript, regsvr32, bitsadmin, certutil, curl/wget, net utilities, and common discovery/utility binaries (whoami, tasklist, ipconfig, nltest, systeminfo, charmap, calc, mspaint, etc.). Observed in-the-wild activity also shows use of base64-encoded commands and, in some cases, spawning of charmap.exe as SYSTEM under pc-app.exe. The rule covers similar behavior from PaperCut Hive components (pc-printjob-spooler.exe) that launch cmd.exe with controlled command lines. The detection relies on Windows process start events and the process hierarchy (child processes whose parent is pc-app.exe or pc-printjob-spooler.exe) to identify potential exploitation or post-exploitation activity. MITRE ATT&CK mappings include T1190 (Exploit Public-Facing Application) for initial access and T1059 with subtechniques (PowerShell and Windows Command Shell) for execution. The rule is designed for endpoints using multiple security telemetry sources (Sysmon, Windows Security Event Logs, Defender XDR, SentinelOne Cloud Funnel, CrowdStrike, Elastic Defend/Endgame) and is aligned with a high-severity, high-priority investigation scenario involving PaperCut servers exposed to the internet or misconfigurations. Remediation guidance emphasizes isolation, patching to fixed builds, preserving artifacts, and credential rotation if compromise is suspected, with attention to correlated activity across host and network telemetry.