This rule detects potential Nimbuspwn-related privilege escalation on Linux by spotting directory traversal attempts performed by the networkd-dispatcher process. The analytic targets Linux endpoints and uses endpoint process telemetry to identify when a networkd-dispatcher process attempts to access parent directories (pattern similar to ../*) which can indicate an attempt to traverse the filesystem to reach privileged locations. The search leverages Splunk’s data model for Endpoint.Processes and requires logs that include the process GUID, process name, parent process, and complete command-line arguments. When matched, the rule surfaces a finding titled “Possible Nimbuspwn privilege escalation via [process] by [user] on [dest]” with a threat score (50) and contextual fields such as user, destination, involved process, and parent/child process relationships. The detection aligns to Linux privilege escalation, persistence, and post-exploitation themes and references CVEs associated with Nimbuspwn (CVE-2022-29799, CVE-2022-29800) and MITRE ATT&CK technique T1068. It supports investigators by providing drilldowns to view results by user/destination and to review associated risk events, enabling rapid triage. Known false positives include legitimate admin or maintenance tasks that traverse directories, so operators should filter against approved administrative activity and trusted system processes. The rule relies on endpoint telemetry and CIM-normalized fields to enable correlation with other detections and risk signals across Splunk environments.