Windows: ArcSOC.exe Creates Potentially Malicious Script or Executable Files

Alerts when ArcSOC.exe creates files with script/executable extensions such as .exe, .ps1, .aspx, or .bat.

FreeUnreviewedSigmahighv1

windows-arcsoc-exe-creates-potentially-malicious-script-or-executable-files-e890acee

title: "Windows: ArcSOC.exe Creates Potentially Malicious Script or Executable Files"
id: c272537b-5e41-4d81-9326-ecee505e549f
status: experimental
description: This rule flags file creation events where ArcGIS Server’s ArcSOC.exe writes to disk a file with extensions commonly associated with executables and scripts. Such activity is suspicious because ArcSOC.exe is expected to host REST services, and creating code-like files can indicate persistence, execution staging, or other attacker behavior. It relies on Windows file event telemetry capturing the creating process path and the created TargetFilename extension.
references:
  - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
  - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml
author: Micah Babinski, Huntrule Team
date: 2025-11-25
tags:
  - attack.command-and-control
  - attack.persistence
  - attack.initial-access
  - attack.execution
  - attack.stealth
  - attack.t1127
  - attack.t1105
  - attack.t1133
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \ArcSOC.exe
    TargetFilename|endswith:
      - .ahk
      - .aspx
      - .au3
      - .bat
      - .cmd
      - .dll
      - .exe
      - .hta
      - .js
      - .ps1
      - .py
      - .vbe
      - .vbs
      - .wsf
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e890acee-d488-420e-8f20-d9b19b3c3d43
    type: derived

What it detects

This rule flags file creation events where ArcGIS Server’s ArcSOC.exe writes to disk a file with extensions commonly associated with executables and scripts. Such activity is suspicious because ArcSOC.exe is expected to host REST services, and creating code-like files can indicate persistence, execution staging, or other attacker behavior. It relies on Windows file event telemetry capturing the creating process path and the created TargetFilename extension.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.