This rule detects Linux web-server activity that writes a new, non-deleted file with high entropy and a web-related extension, which is a common indicator of encoded or encrypted payloads being uploaded via exposed web applications. It uses an EQL query on endpoint file events to identify writes by web server processes (e.g., nginx, apache2/httpd, php-cgi/fcgi, uwsgi, etc.) where the written file has entropy at or above 6.0 and an extension from a curated set of web/script payload formats (php, phtml, jsp, js, py, lua, sh, elf, bin, and related variants). The rule narrows to Linux hosts and checks that the file is not being deleted, aiming to flag attempts to plant obfuscated payloads such as web shells (e.g., through exploited upload endpoints) and subsequently execute them. MITRE ATT&CK mappings include: Web Shell (TA0003, T1505.003) under Persistence, Exploit Public-Facing Application (TA0001, T1190) under Initial Access, and Exploitation of Remote Services (TA0008, T1210) under Lateral Movement, reflecting potential attacker progression after initial foothold. The detection relies on file.Ext.* fields, which require Elastic Defend integration with a Linux policy that enables linux.advanced.events.populate_file_data to capture these fields. The rule is marked high severity with a risk score of 73. Operational notes in the setup section describe integration steps and the need to enable advanced file data capture. Triage guidance emphasizes validating the file’s type, path, hash, and relation to document roots or upload points; correlating with process ancestry and network activity; and isolating the host if malicious. Remediation includes quarantining/removing the artifact, patching the exploited component, rotating credentials, hardening upload validation, and retaining artifacts for forensics. False positives may occur from legitimate deployments or scripts generating high-entropy assets; verify against deployment records and known-good caches.