Detects creation or modification of files under /etc/update-motd.d, the Linux MOTD script directory that runs at user login. Legitimate admins may modify these scripts, so the rule notes potential false positives and allows filtering by authorized users. The detection ingests endpoint filesystem events (mapped to the Endpoint.Filesystem data model via EDR telemetry) and uses a Splunk CIM-normalized search to flag events where Filesystem.file_path matches /etc/update-motd.d/* and Filesystem.action is created or modified. The search aggregates by file_path, file_name, user, destination, action, process_guid, and process_id, then formats firstTime/lastTime and presents a filtered view with linux_motd_script_added_filter. Analytic story places this under Linux Persistence Techniques and Linux Post-Exploitation. MITRE mappings include T1547 (Boot or Logon Autostart), T1037 (Login Script), and T1059.004 (Unix Shell). The rule provides drilldown options to view results per user/destination and to examine related risk events. It is supported by a dataset and tests referencing Linux MOTD script additions and is designed to be implemented with Splunk’s EDR integrations, using the Common Information Model for normalization. References include a GitHub source and a provided test dataset.