This Elastic rule is a new_terms-based detection titled “Unusual File Creation via Web Server.” It targets Linux endpoint hosts and flags anomalous file creation or rename events that originate from web server-related processes. The detector monitors events where event.category is file and host.os.type is linux, and event.action is creation or rename. It enumerates a broad set of web server and web application processes (nginx, apache2/httpd, php-fpm, various CGI/fastcgi wrappers, Java with JSP/ WAR extensions, Node.js, Python, Ruby, Perl, Lua, .NET runtimes, and related frameworks) and triggers when these processes create or rename files in web-accessible paths. The file.path filter covers common web document roots and deployment directories (e.g., /var/www, /home, /srv/www, /wwwroot, wp-content, cgi-bin, uploads, public_html, htdocs, and related platform-specific locations). This combination is designed to reveal potential web shells or persistence/exploitation activity in web-facing contexts, where attackers may write scripts, PHP/JS files, or CGI payloads to web directories. The rule aligns to MITRE ATT&CK techniques: Web Shell (T1505.003) under Persistence, Unix Shell (T1059.004) under Execution, Application Layer Protocol (T1071) under C2, and Exploit Public-Facing Application (T1190) under Initial Access. It uses a history window (now-7d) to identify new terms within the last week and applies the rule within a short window (from now-9m), using new_termsFields file.path, host.id, and process.executable to detect deviations. The detection is tagged as low severity with a risk_score of 21 and integrates with Elastic Defend data sources, operating on logs-endpoint.events.file*. with timestamp_override set to event.ingested.