Sigma rule: Suspicious File Created by ArcSOC.exe

Rule

Title

Suspicious File Created by ArcSOC.exe

Status

experimental

Level

high

Author

Micah Babinski

Date

2025-11-25

File

rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.

Log source

product

windows

category

file_event

Detection

selection:
    Image|endswith: '\ArcSOC.exe'
    TargetFilename|endswith:
        - '.ahk'
        - '.aspx'
        - '.au3'
        - '.bat'
        - '.cmd'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.js'
        - '.ps1'
        - '.py'
        - '.vbe'
        - '.vbs'
        - '.wsf'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.command-and-control
• attack.persistence
• attack.initial-access
• attack.execution
• attack.stealth
• attack.t1127
• attack.t1105
• attack.t1133

MITRE ATT&CK ids this rule names

• T1105
• T1127
• T1133

References

• https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
• https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml