Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe
Alerts when ArcSOC.exe launches cmd/cscript/mshta/powershell/wscript and similar interpreters, indicating potential remote code execution.
- Product
- windows
- Category
- process_creation
- Author
- Micah Babinski (SigmaHQ), DRL 1.1
- Published
- 2025-11-25
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where ArcSOC.exe spawns common script interpreters and command-line tooling such as cmd.exe, PowerShell, and WScript/WSH binaries. Such parent-child relationships can indicate remote code execution attempts launched from the ArcGIS Server REST service host process. It relies on Windows process creation telemetry with the parent image ending in \ArcSOC.exe and the child image matching known interpreter/tool executable names.
Reporting behind it
- reliaquest.comhttps://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
- enterprise.arcgis.comhttps://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe"
id: 4c4e26ef-0597-4bfa-a064-ce819a5b0b05
status: experimental
description: This rule flags process creation events where ArcSOC.exe spawns common script interpreters and command-line tooling such as cmd.exe, PowerShell, and WScript/WSH binaries. Such parent-child relationships can indicate remote code execution attempts launched from the ArcGIS Server REST service host process. It relies on Windows process creation telemetry with the parent image ending in \ArcSOC.exe and the child image matching known interpreter/tool executable names.
references:
- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
- https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
author: Micah Babinski, Huntrule Team
date: 2025-11-25
tags:
- attack.execution
- attack.t1059
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \ArcSOC.exe
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \wmic.exe
- \wscript.exe
filter_main_cmd:
Image|endswith: \cmd.exe
CommandLine: cmd.exe /c "ver"
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8e95e73e-ba02-4a87-b4d7-0929b8053038
type: derived