This ES|QL rule detects suspicious activity around a Ray worker process, specifically ray/_private/workers/default_worker.py, spawning a shell or an inline Python command (python -c / python3 -c) or invoking a discovery/download utility. Because Ray runs job entrypoints through a shell, a Python reverse shell can appear as a shell command (e.g., sh -c or bash -c) that starts a Python process. The rule flags when a Python process is a child of the Ray worker and the child or its command line uses a shell or common download/interactive commands, with particular attention to a Python process whose arguments include -c. This helps uncover attempts to exfiltrate data, tamper with served models, or misuse Ray infrastructure in exposed clusters (e.g., CVE-2023-48022). The detection is mapped to MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application) under Initial Access, T1059 (Command and Scripting Interpreter) with subtechniques T1059.001 (PowerShell), T1059.003 (Windows Command Shell), T1059.004 (Unix Shell), and T1059.006 (Python); T1033 (System Owner/User Discovery); T1082 (System Information Discovery); and T1105 (Ingress Tool Transfer) under Command and Control. The rule is designed for endpoints across Windows, Linux, and macOS and relies on process-level data emitted by Elastic Defend’s Process data source. Practical triage steps emphasize validating whether the entrypoint is an approved Ray job, reviewing the parent-child process lineage and outbound connections, assessing the Ray dashboard exposure, and rotating credentials or locking down access if unauthorized activity is observed. False positives are mitigated by distinguishing legitimate Ray jobs (which typically originate from the same worker and may appear as cmd.exe /c or sh -c) from suspicious activity in unapproved workloads. Remediation includes stopping suspicious child processes, isolating the host if outbound communication occurred, removing dropped artifacts, rotating credentials, and securing the Ray dashboard behind authentication.