Issue Summary

The current detection logic treats the /app endpoint as an independent indicator of suspicious activity. However, /app is a generic endpoint used by many different web applications, not exclusively by PaperCut NG.

Filtering or alerting on this endpoint in isolation leads to excessive false positives, as legitimate traffic from unrelated applications frequently matches this pattern.

Impact

High false-positive rate

Significant alert noise in environments hosting multiple web applications

Reduced analyst confidence in the detection

Increased triage time for non-malicious events

Technical Rationale

/app is a commonly used endpoint across a wide range of web frameworks and products.

Many non-PaperCut applications legitimately expose or access this path.

The rule does not sufficiently validate that the traffic is uniquely associated with PaperCut NG before triggering.

Without additional context (such as application-specific paths, exploit indicators, or version-aware logic), /app alone is not a reliable signal of exploitation.

Recommendation

Remove /app as a standalone detection condition.

Scope the rule more narrowly to PaperCut NG–specific indicators.

Correlate web access with stronger signals, such as:

Known PaperCut exploit paths

Abnormal request parameters

Authentication bypass behavior

Confirmed vulnerable versions

Suspicious HTTP methods or response patterns

Expected Outcome

Lower false-positive rates

Improved detection fidelity

More actionable alerts for real PaperCut NG exploitation attempts.