Suspicious ArcSOC.exe Child Process (via process_creation)

This rule detects script interpreters, command-line tools, and similar anomalous child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an adversary compromises an ArcGIS Server system and uploads a hostile Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.