Hunting for Compromise Before the Vendor Publishes Indicators

The gap nobody plans for

PaperCut's August 2026 advisory for NG and MF confirmed active exploitation and promised indicators of compromise later. That gap between "you may be breached" and "here is what to look for" is common, and it is exactly when defenders need a method rather than a list. Curated indicators are a convenience; they are not a prerequisite for a hunt.

This guide describes a hunting approach that starts from what you know about the affected system and its normal behavior, not from attacker artifacts you do not have yet. It uses the PaperCut Application Server as the worked example, but the method generalizes to any service under a zero-dayZero-Day🛡️A security vulnerability that is exploited or publicly disclosed before the software vendor can release a patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program., giving developers 'zero days' to fix it..

Start from the trust boundary

Every exploited vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. has an entry point, and you usually know it even when the bug is undisclosed. For PaperCut it is the web interface. Ask three questions:

1. Was the entry point reachable from untrusted networks, and for how long?
2. What sits behind it that an attacker would want, and with what privileges?
3. What does the system do when it is working normally, and what would it never do?

The answers scope the hunt. If the interface was internet-facing for the past year and the process runs as SYSTEM, you are hunting for post-exploitation on a fully privileged host, and you should widen the window well beyond the disclosure date. Exploitation typically precedes disclosure.

Process lineageProcess Lineage🛡️The parent-child chain of processes on a host, showing which process launched which. Hunting on lineage catches exploitation because compromised services spawn children they never would in normal operation. is your best signal

Application servers have predictable process trees. A print server's `pc-app.exe` launches a small, fixed set of helpers. It does not launch PowerShell, `cmd.exe`, `certutil`, `bitsadmin`, `rundll32`, scripting hosts, or anything that connects to the internet. When it does, that is either an administrator doing something unusual or an exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access..

Query your EDR or Sysmon data for every process whose parent is the application process, going back as far as retention allows. Group by child image name and command line. The legitimate set will be short and repetitive; anything outside it is a lead. In the 2023 PaperCut campaign, Huntress observed exactly this pattern: `cmd.exe` and hidden-window PowerShell spawned under the application to download installers. The same technique will look the same in your telemetry whether or not the vulnerability is new.

Extend the query one level further: children of those suspicious children, and any process that later runs with the same user context and connects outbound.

Log integrity before log content

PaperCut's own guidance lists missing, truncated, or deleted `server.log` files as a compromise indicator. That is a general truth. Attackers who care about persistence tamper with the application's log before they do anything else worth logging.

Check the log directory for:

• Files smaller than their rotation peers, or a current log that starts abruptly without the usual startup banner.
• Gaps in timestamps that do not correspond to a restart or maintenance window.
• Rotated logs that are missing from a sequence.
• Modification times on log files that differ from the last write recorded inside them.

If the application ships logs to a SIEM, compare the SIEM's copy against the local copy. Local deletion cannot reach the central store, and a divergence is close to proof.

Only after confirming integrity does searching log content make sense. When the vendor does publish strings, as PaperCut did with its two JDBC and card-lookup error messages, run them across the entire retained history, not just the last week.

Hunt for the errors the application should not produce

Exploitation attempts leave failures behind, because attackers probe before they succeed. Search application logs for error classes that correspond to malformed input reaching internal components: database driver errors with strange connection strings, type-cast failures in fields that should only ever hold numbers, deserializationDeserialization🛡️The process of converting stored or transmitted data back into an object. Insecure deserialization can allow attackers to execute code by manipulating serialized data. exceptions, path-traversal rejections, and authentication events with impossible sequences (a session used before it was created, or an admin login with no preceding page load).

Baseline the normal error rate first. A production server produces a background hum of benign errors; a spike in one class, or a class that has never appeared before, is the signal. This is how a defender would have found the PaperCut card-ID cast error before the vendor named it.

Follow the credentials

The application's service accountService Account🛡️A non-human operating system or application account under which a service runs. Its permissions define the blast radius of any exploit against that service, since attacker code executes with the service account's access to files, secrets, and the network. is the attacker's next step. Pull authentication logs for that account across the directory: where it logged in from, at what hours, and to what systems. A print server's service account authenticates to the directory and to the print server itself. It does not authenticate interactively to file servers, jump hosts, or domain controllers. Any such event is a lead regardless of what else you find.

Check the account's group membership against the last known-good state. Attackers with SYSTEM on a domain-joined server frequently add rights to accounts they already control rather than creating new ones that trip alerts.

Network behavior

From the firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. or flow logs, list every outbound destination from the server. An application server has a small set of legitimate egress targets: the vendor's update and licensing endpoints, the directory, the database if it is external, and the devices it manages. New destinations, especially direct-to-IP connections, cloud storage services, or anything on unusual ports, warrant a look. Include DNS queries; a server that suddenly resolves a domain it has never resolved is telling you something.

Decide, then act

A hunt with no curated indicators will surface ambiguous findings. Set the decision rule in advance: if the interface was exposed and you cannot prove the logs are intact, treat the server as compromised. That means isolating it, rotating the service account and any credentials it stores, rebuilding rather than cleaning, and expanding the hunt to the systems the account touched. The cost of an unnecessary rebuild is a weekend; the cost of a missed foothold is a ransomware incident.

If the hunt comes up clean and the logs are verifiably complete, document the evidence, apply the vendor's patch, and close the exposure using the steps in the guide on restricting a web admin interface to trusted IP addresses. Then decide whether the system should have been reachable in the first place; the explainer on why print management servers are a high-value target is a good input to that conversation.

Build the muscle now

Everything above depends on having process-creation telemetry, centralized logs, flow data, and a baseline of normal behavior before the advisory lands. None of it can be bolted on the day a vendor says "we are aware of confirmed customer incidents." The organizations that hunted effectively on August 27 were the ones that had spent the previous year collecting the data.