ArcSOC.exe Spawns Script and Command Interpreters (Windows Process Creation)

title: ArcSOC.exe Spawns Script and Command Interpreters (Windows Process Creation)
id: 4c4e26ef-0597-4bfa-a064-ce819a5b0b05
status: experimental
description: This rule flags Windows process creations where ArcSOC.exe is the parent process and spawns common script interpreters and command-line execution tools. Such activity is important because an attacker who compromises an ArcGIS Server host could execute payloads indirectly through the ArcSOC.exe process, leveraging crafted requests to run code from that service context. The rule relies on process creation telemetry including parent image path, child image path, and child command line.
references:
  - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
  - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
author: Micah Babinski, Huntrule Team
date: 2025-11-25
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ArcSOC.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wmic.exe
      - \wscript.exe
  filter_main_cmd:
    Image|endswith: \cmd.exe
    CommandLine: cmd.exe /c "ver"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8e95e73e-ba02-4a87-b4d7-0929b8053038
    type: derived