ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Alerts when ArcSOC.exe creates files with script/executable extensions such as .exe, .ps1, .aspx, or .bat.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Micah Babinski (SigmaHQ), DRL 1.1
Published: 2025-11-25
Updated: 2026-07-31

ATT&CK techniques

Initial Access → C2

Recon
Resource Dev
Initial Access
- T1133External Remote Services
Execution
- T1127Trusted Developer Utilities Proxy Execution
Persistence
- T1133External Remote Services
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags Windows file creation events where ArcGIS Server’s ArcSOC.exe creates a file with an ending that matches common executable and script types. Attackers may use the web services process to drop payloads or stage persistence via unusual file creation. The detection relies on Windows file event telemetry that includes the creating process path (ending with \ArcSOC.exe) and the created file name suffix.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Suspicious Remote Script Transfer via Bitsadmin (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Malicious Curl MSI Download to ProgramData via Process Creation

Suspicious CloudZ RAT Payload Download via curl to ProgramData

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

Suspicious PowerShell Download of lib.zip Archive

Suspicious File Download Via Bitsadmin Transfer

Suspicious PowerShell Download Of Text-Disguised Payload

Explorer WebDAV UNC Download Using At-Port Syntax

ArcSOC.exe Creates Suspicious Script/Executable Files on Windows

Pivot detection · T1105 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-arcsoc-exe-creates-potentially-malicious-script-or-executable-files-e890acee

title: ArcSOC.exe Creates Suspicious Script/Executable Files on Windows
id: c272537b-5e41-4d81-9326-ecee505e549f
status: experimental
description: This rule flags Windows file creation events where ArcGIS Server’s ArcSOC.exe creates a file with an ending that matches common executable and script types. Attackers may use the web services process to drop payloads or stage persistence via unusual file creation. The detection relies on Windows file event telemetry that includes the creating process path (ending with \ArcSOC.exe) and the created file name suffix.
references:
  - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
  - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml
author: Micah Babinski, Huntrule Team
date: 2025-11-25
tags:
  - attack.command-and-control
  - attack.persistence
  - attack.initial-access
  - attack.execution
  - attack.stealth
  - attack.t1127
  - attack.t1105
  - attack.t1133
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: \ArcSOC.exe
    TargetFilename|endswith:
      - .ahk
      - .aspx
      - .au3
      - .bat
      - .cmd
      - .dll
      - .exe
      - .hta
      - .js
      - .ps1
      - .py
      - .vbe
      - .vbs
      - .wsf
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e890acee-d488-420e-8f20-d9b19b3c3d43
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL