2025_ArcGIS_Server_SOE_Abuse | Detection.FYI

ArcSOC.exe Creating Suspicious Files

Nov 25, 2025 · attack.defense-evasion attack.command-and-control attack.persistence attack.t1127 attack.t1105 attack.t1133 ·
Share on:

Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates files with suspicious file types, indicating that they may be executables, script files, or otherwise unusual.

Read More
Suspicious ArcSOC.exe Child Process

Nov 25, 2025 · attack.execution attack.t1059 attack.t1203 ·
Share on:

This rule detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.

Read More