This rule detects a two-step sequence on Linux endpoints: (1) a network connection initiation by a binary executing from commonly writable locations (e.g., /boot, /tmp, /var/tmp, /var/log, /run/user), followed within a short window (maxspan=5s) by (2) a file creation event in similar locations. The pattern mirrors behavior seen in certain C2 agents that poll a C2 framework (e.g., Mythic) and then execute commands. The rule employs extensive path-based exclusions to reduce noise, such as ignoring benign processes and files, and filtering destinations (excluding null, 0.0.0.0, localhost-like and many private/internal ranges). It is designed to identify post-initial-contact C2 activity that leverages an application-layer protocol (web protocols) and subsequent shell execution. The rule is mapped to MITRE ATT&CK techniques: T1071 (Application Layer Protocol) with subtechnique T1071.001 (Web Protocols) and T1059.004 (Unix Shell) under Execution. It uses data from Linux network and file events collected via Elastic Defend and runs within the Elastic Security framework. The rule’s intent is to detect early-stage C2 activity and command execution patterns consistent with modern C2 frameworks, using a Linux-only scope with specific host-path and process-name filters to minimize false positives.