Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe

title: "Windows: Suspicious Script/Command Child Processes Spawned by ArcSOC.exe"
id: 4c4e26ef-0597-4bfa-a064-ce819a5b0b05
status: experimental
description: This rule flags process creation events where ArcSOC.exe spawns common script interpreters and command-line tooling such as cmd.exe, PowerShell, and WScript/WSH binaries. Such parent-child relationships can indicate remote code execution attempts launched from the ArcGIS Server REST service host process. It relies on Windows process creation telemetry with the parent image ending in \ArcSOC.exe and the child image matching known interpreter/tool executable names.
references:
  - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
  - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
author: Micah Babinski, Huntrule Team
date: 2025-11-25
tags:
  - attack.execution
  - attack.t1059
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \ArcSOC.exe
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wmic.exe
      - \wscript.exe
  filter_main_cmd:
    Image|endswith: \cmd.exe
    CommandLine: cmd.exe /c "ver"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8e95e73e-ba02-4a87-b4d7-0929b8053038
    type: derived