Linux Ghostscript Exploitation detects when Ghostscript is used to spawn a shell to execute arbitrary commands, indicating potential post-exploitation or document-processing abuse on Linux endpoints. The rule looks for a process where the parent is gs or ghostscript and the child command line starts with sh -c, capturing relevant fields such as process, parent process name/path, user, destination, and file paths from the Endpoint.Processes CIM data model. It relies on complete command lines and process GUIDs and is mapped to Splunk CIM/EDR telemetry. The finding aligns with CVE-2024-29510 and MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter), T1068 (Exploitation for Privilege Escalation), T1204.002 (User Execution: Malicious File), and T1566 (Phishing). Known false positives include legitimate Ghostscript usage for document conversion; mitigate by whitelisting trusted Ghostscript usage. References include articles about Ghostscript CVE exploitation.