This rule detects the creation of Linux udev rule files in the standard persistence locations /etc/udev/rules.d and /usr/lib/udev/rules.d. Adversaries can abuse udev rules by embedding RUN+= directives that execute arbitrary commands when device events occur (e.g., USB plug-in or network changes). Because the udev daemon runs with elevated (root) privileges, a malicious or misconfigured RUN+= rule can yield persistence and privilege escalation, and has been observed in post-exploitation toolkits (e.g., PANIX). The detection leverages endpoint telemetry (filesystem events) collected via EDR/Sysmon-like data and mapped to the Endpoint data model in Splunk CIM. The provided Splunk search filters for file creations in the udev rules directories, then groups by action, destination, and metadata to surface suspicious rule creation events, including the file path, creator, and destination device. Intermediate findings flag a new udev rule created under a specific path by a user. The rule is associated with MITRE techniques T1547 (Boot or Logon Autoinitiated/Startup) and T1037 (Boot or Logon Initialization Scripts). False positives include legitimate administrator activity or software installers creating rules; filtering guidance emphasizes known admin actions and trusted software. The rule includes drilldown queries for per-user and risk-event context over the last 7 days, and a True Positive Test dataset to validate behavior. Analytically, this supports Linux persistence, post-exploitation, and privilege escalation detection. It is designed for endpoint security monitoring within Splunk Enterprise/Security and Splunk Cloud environments and aligns with the Endpoint/Linux threat landscape.