This rule detects Linux processes that attempt to read the procfs syscall interface to enumerate syscall arguments, stack pointer, and instruction pointer via /proc/<pid>/syscall. Such access is typically used for process discovery or to prep for process injection on Linux hosts. The rule triggers on Linux hosts when a new process starts (event.type in start) and the action is one of exec/exec_event/start/ProcessRollup2. It then requires the process command line to reference a procfs syscall path (*/proc/*/syscall*) and excludes benign/self-references (*/proc/self/syscall*, */proc/thread-self/syscall*) or comm reads (args like /proc/*/syscall/comm). To reduce noise, the rule flags either: (1) common command names that often inspect executables or document content (cat, less, more, head, tail, nano, vi/vim variants, strings, od, hexdump, xxd, hexedit, pager, tr), or (2) process families (find, awk, gawk, mawk, nawk, grep, fgrep, rgrep, xargs, sed, tee) with argument counts <= 20. The combination of a Linux start event, a suspicious command line targeting /proc/<pid>/syscall, and exclusion of legitimate/self-referencing paths indicates potential discovery or preparation for process injection, aligning with MITRE ATT&CK discovery techniques (T1057). This rule provides targeted visibility into Linux endpoint behavior that could precede privilege escalation or code injection activity.