Detections

title: Public-source process and network behavior
id: 41f18142-8b87-5138-962f-c160bc5a5100
status: test
description: Detects behavior described in the cited public report; field mapping requires local validation.
author: CTI-Hermes
date: 2026/08/29
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process_name: powershell
    parent_process_name: cmd.exe
  condition: selection
falsepositives:
  - Administrative scripts
level: medium
references:
  - https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/