{"id":"8e95e73e-ba02-4a87-b4d7-0929b8053038","title":"Suspicious ArcSOC.exe Child Process","description":"Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.\nArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS\nServer system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding\nservice endpoint and remotely execute code from the ArcSOC.exe process.\n","author":"Micah Babinski","status":"experimental","level":"high","date":"2025-11-25","modified":"","tags":["attack.execution","attack.t1059","attack.t1203"],"technique_ids":["T1059","T1203"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/","https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm"],"source_path":"rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml","source_sha256":"0d69f0aad73732e5af619707a42d0013c6fb08cae11905b5c6bc4f315f04f5cb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious ArcSOC.exe Child Process\nid: 8e95e73e-ba02-4a87-b4d7-0929b8053038\nstatus: experimental\ndescription: |\n    Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.\n    ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS\n    Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding\n    service endpoint and remotely execute code from the ArcSOC.exe process.\nreferences:\n    - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/\n    - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm\nauthor: Micah Babinski\ndate: 2025-11-25\ntags:\n    - attack.execution\n    - attack.t1059\n    - attack.t1203\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\ArcSOC.exe'\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\wmic.exe'\n            - '\\wscript.exe'\n    filter_main_cmd:\n        Image|endswith: '\\cmd.exe'\n        CommandLine: 'cmd.exe /c \"ver\"'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059","id":"T1059","name":"Command and Scripting Interpreter","page":"techniques/enterprise/T1059/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/8e95e73e-ba02-4a87-b4d7-0929b8053038.json","kind":"sigma"}