This detection rule flags the creation or renaming of executables originating from writable, transient, or memory-backed locations when a dot-prefixed file is written into a trusted system directory on Linux. Adversaries may use temporary directories (e.g., /tmp, /dev/shm, /run), memory-backed paths, or web-accessible locations to stage a payload and conceal it by creating a hidden file in a system directory (such as /bin, /usr/bin, /lib, /etc, etc.). The rule correlates a suspicious process activity (process.executable matching common writable or temp paths) with a file event (file.path in system directories and file.name matching a dot-prefixed pattern) and an event action of creation or rename. When combined, these indicators suggest defense-evasion activity or persistence artifacts. The detection is implemented as an Elastic EQL rule and maps to MITRE ATT&CK defense-evasion techniques: T1564 Hide Artifacts and subtechnique T1564.001 Hidden Files and Directories. The rule carries a risk_score of 73 and is designed for Linux endpoints monitored by Elastic Defend via Elastic Agent. Operators should investigate the creating process lineage, file ownership, permissions, and file hashes, determine how the suspicious executable reached the host, and look for any downstream actions (read, execute, rename, delete, or transmission). Remediation involves isolating the host if unauthorized, removing the artifact, rotating credentials if exposed, and restoring system binaries from trusted sources, followed by monitoring for recurrence and re-enablement of defenses.