huntrule

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Alerts when ArcSOC.exe creates files with script/executable extensions such as .exe, .ps1, .aspx, or .bat.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Micah Babinski (SigmaHQ), DRL 1.1
Published
2025-11-25
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows file creation events where ArcGIS Server’s ArcSOC.exe creates a file with an ending that matches common executable and script types. Attackers may use the web services process to drop payloads or stage persistence via unusual file creation. The detection relies on Windows file event telemetry that includes the creating process path (ending with \ArcSOC.exe) and the created file name suffix.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange
Suspicious Certutil Download and Certificate Installation via Living-off-the-Land
Suspicious PowerShell Remote Script Execution via IEX DownloadString
Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)
Suspicious Executable Download from Compromised CMS Client Scripts Path (via proxy)
Suspicious HijackLoader PNG Payload Retrieval via ClearFake
Malicious Download Piped to Shell via curl or wget (via process_creation)
Suspicious File Download via busybox ftpget (via process_creation)
Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget
Suspicious PowerShell Download Cradle to Blogspot (via process_creation)
ArcSOC.exe Creates Suspicious Script/Executable Files on Windows
Pivot detection · T1105 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.