Added rules related to ArcGIS Server Object Extension abuse #5774
+84
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
Rules
Review Needed
nasbench
reviewed
Nov 28, 2025
Member
nasbench
left a comment
nasbench
left a comment
There was a problem hiding this comment.
Thanks for this PR @mbabinski. Below are some open questions and suggestions.
rules/windows/file/file_event/file_event_win_arcsoc_creating_susp_files.yml
Outdated
Show resolved
Hide resolved
rules/windows/file/file_event/file_event_win_arcsoc_creating_susp_files.yml
Outdated
Show resolved
Hide resolved
rules/windows/file/file_event/file_event_win_arcsoc_creating_susp_files.yml
Outdated
Show resolved
Hide resolved
rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Outdated
Show resolved
Hide resolved
rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Outdated
Show resolved
Hide resolved
rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Outdated
Show resolved
Hide resolved
rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Outdated
Show resolved
Hide resolved
rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Outdated
Show resolved
Hide resolved
rules/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml
Show resolved
Hide resolved
…le_event_win_arcsoc_susp_file_created.yml
Updated the description for clarity and added 'wmic.exe' to the list of suspicious child processes.
Member
|
@mbabinski qq for you. Do you happen to have an .evtx file containing logs of this chain. Are you able to generate or provide such evtx? |
nasbench
reviewed
Dec 3, 2025
| @@ -0,0 +1,44 @@ | |||
| title: Suspicious File Created by ArcSOC.exe | |||
| id: e890acee-d488-420e-8f20-d9b19b3c3d43 | |||
| status: experimental | |||
Contributor
Author
There was a problem hiding this comment.
Hey @nasbench, unfortunately I don't have access to ArcGIS Server - if I did I would create a server object extension that does something benign like just runs whoami. I reached out to people at ReliaQuest and Esri trying to get more information and specific log entries related to the intrusion but sadly I did not hear back.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of the Pull Request
These rules pertain to the ArcSOC.exe process component of ArcGIS Server. My research indicates that they would be the initiating process of malicious activities as outlined in this recent threat report from ReliaQuest: https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
Changelog
new: ArcSOC.exe Creating Suspicious Files
new: Suspicious ArcSOC.exe Child Process
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions