Detects the first occurrence of using setsid, nohup, or disown to directly execute a process on Linux hosts. This New Terms rule aims to identify attempts to spawn a new session or detach commands from a controlling terminal, which attackers may use for background execution or signal evasion. The rule triggers on Linux host process events where the event category is process, action matches exec/exec_event/executed/process_started/start, and the process name matches setsid, nohup, or disown with exactly two arguments. It sources data from Elastic Defend, Endgame, SentinelOne Cloud Funnel, auditbeat, and auditd manager. It maps to MITRE ATT&CK Execution (T1059 / T1059.004 Unix Shell) and Defense Evasion (T1036 Break Process Trees, T1564 Hide Artifacts). The rule enriches findings with new_terms_fields (process.parent.executable, host.id, process.command_line) and uses a history window of now-5d to identify the first occurrence. Severity is low with a risk_score of 21. Data sources require Elastic Defend integration via Fleet on Linux endpoints.