This anomaly detects execution of a Linux binary by the root user from in-memory shared memory directories (/dev/shm/ and /run/shm/). Attackers often place executables in these tmpfs-backed locations to achieve persistence or launch fileless/semi-fileless payloads on high-uptime servers, since the directories reside in volatile memory and do not persist to disk. The rule relies on Sysmon for Linux EventID 1 (process creation) data ingested into the Endpoint data model. The SPL query filters Endpoint.Processes for process_path matching /dev/shm/* or /run/shm/* and user=root, returning detailed fields such as Processes.process, Processes.process_name, Processes.user, Processes.user_id, Processes.process_hash, and parent process context. It leverages CIM-normalized fields and Splunk macros for time normalization and object naming. The analytic is associated with Linux Post-Exploitation, Linux Persistence Techniques, and Privilege Escalation, mapped to MITRE ATT&CK technique T1059. The rule includes drilldowns to view results for specific users/destinations and to view related risk events over the last 7 days, along with intermediate findings highlighting destination and user context. False positives may occur when legitimate software uses shared memory directories for IPC or temporary storage; these should be filtered against known software behavior. References provide context on Linux fileless malware and sample detections, and the rule integrates with common Splunk/EIM workflows to facilitate investigation.