Detects execution of Docker containers with elevated privileges on Linux endpoints by analyzing endpoint process telemetry normalized to the Splunk CIM Endpoint.Processes data model. The analytic searches for Docker run commands where the process name contains docker and run, and the command line includes --privileged or --pid=host, indicating a privileged container or host-namespace access. On match, the rule surfaces rich process context (process name, path, current directory, parent process name/path, hash, user, vendor_product, process_id, etc.) to aid incident investigation and response. It maps to MITRE ATT&CK techniques T1610 (Privilege Escalation) and T1059.004 (Linux Command and Scripting Interpreter). Categories include Linux Post-Exploitation, Linux Privilege Escalation, Linux Persistence Techniques, and Compromised Linux Host. Known false positives include legitimate administrative maintenance or debugging tasks; mitigate by filtering trusted admin users and approved container workflows. To implement, ensure endpoint logs provide complete command lines and that data is mapped to the Endpoint.Processes datamodel with CIM normalization for field consistency.