Detects suspicious creation of sensitive Linux system files outside canonical system locations to identify staging of an alternate root directory and potential library hijacking aligned with CVE-2025-32463 (chwoot). The analytic watches for file_path events corresponding to critical files such as nsswitch.conf, passwd, shadow, sudoers, and older PAM/SysV references, as well as NSS shared libraries (e.g., libnss_*). It flags creations that occur outside /etc/* and /var/lib/docker/*, which may indicate an attacker staging a fake root directory to influence name resolution and privileged process behavior (e.g., hijacking library loading without modifying the real /etc). Implemented as a Splunk tstats-based detection over the Endpoint.Filesystem data model, it correlates the file event with contextual process/user information to surface attribution and timing, including file hash, timestamps, process GUID/ID, and destination. The rule surfaces intermediate findings such as the targeted destination and file name, enabling rapid investigation of potential privilege-escalation chains and post-exploitation activity. The analytic story links this technique to Linux Privilege Escalation, Post-Exploitation, and Persistence Techniques. Known false positives include legitimate testing, containerized or development environments where staging of files for configuration or testing occurs; filtering should consider known development hosts. References anchor the technique to credible sources (CVE-2025-32463/chwoot) and related security coverage. The detection is designed for Linux endpoints and is relevant to Splunk Enterprise/Splunk Enterprise Security/Splunk Cloud deployments, with a MITRE-ATT&CK mapping to T1036 (Masquerading) as applicable to library/path manipulation scenarios. Operationally, it requires ingestion of EDR or equivalent filesystem creation events mapped to the CIM Endpoint data model, and normalization of fields to enable the provided drilldowns and intermediate findings.