This anomaly rule detects when the root user on a Linux endpoint executes the id command, a common post-exploitation step used to verify privilege elevation. The search targets endpoint process telemetry, filtering for processes where path is /usr/bin/id and the user is root. It gathers rich context from the Endpoint.Processes data model (process name, path, hash, PID, parent process, user, destination/host, etc.), and uses Splunk CIM-normalized fields to produce concise detection results. The search reports first and last execution times for matching events and includes a drilldown workflow to view results by user and destination, plus a risk-context view for the past 7 days. The rule is linked to Linux-era attack logic (Linux Post-Exploitation, Linux Privilege Escalation, Linux Persistence) and maps to MITRE ATT&CK technique T1033 (Account Discovery / Privilege context). It includes a true-positive test dataset and a known-false-positives section noting administrators or automated scripts may legitimately run id as root for auditing. Implementation guidance emphasizes ingesting complete command lines and process GUIDs from an EDR, mapping logs to the Endpoint data model, and normalizing fields with the Splunk CIM to enable accurate detections across Splunk platforms (Enterprise, Enterprise Security, and Cloud).