{"id":"e890acee-d488-420e-8f20-d9b19b3c3d43","title":"Suspicious File Created by ArcSOC.exe","description":"Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS\nserver, creates a file with suspicious file type, indicating that it may be an executable, script file,\nor otherwise unusual.\n","author":"Micah Babinski","status":"experimental","level":"high","date":"2025-11-25","modified":"","tags":["attack.command-and-control","attack.persistence","attack.initial-access","attack.execution","attack.stealth","attack.t1127","attack.t1105","attack.t1133"],"technique_ids":["T1105","T1127","T1133"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Unlikely"],"references":["https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/","https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm"],"source_path":"rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml","source_sha256":"3a0b40423e33d2097c98dac888a3162857e995314ad57dd2b40250a0a4814c6d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious File Created by ArcSOC.exe\nid: e890acee-d488-420e-8f20-d9b19b3c3d43\nstatus: experimental\ndescription: |\n    Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS\n    server, creates a file with suspicious file type, indicating that it may be an executable, script file,\n    or otherwise unusual.\nreferences:\n    - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/\n    - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm\nauthor: Micah Babinski\ndate: 2025-11-25\ntags:\n    - attack.command-and-control\n    - attack.persistence\n    - attack.initial-access\n    - attack.execution\n    - attack.stealth\n    - attack.t1127\n    - attack.t1105\n    - attack.t1133\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\ArcSOC.exe'\n        TargetFilename|endswith:\n            - '.ahk'\n            - '.aspx'\n            - '.au3'\n            - '.bat'\n            - '.cmd'\n            - '.dll'\n            - '.exe'\n            - '.hta'\n            - '.js'\n            - '.ps1'\n            - '.py'\n            - '.vbe'\n            - '.vbs'\n            - '.wsf'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1127","id":"T1127","name":"Trusted Developer Utilities Proxy Execution","page":"techniques/enterprise/T1127/"},{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","page":"techniques/enterprise/T1133/"}],"data_path":"data/detection-rules/e890acee-d488-420e-8f20-d9b19b3c3d43.json","kind":"sigma"}