Detects potential Linux bootloader modifications by monitoring processes that write to or manipulate files in the EFI/BOOT path, which are critical for initializing the system boot process. The analytic queries the Endpoint.Processes data model (via the CIM-normalized fields) to identify suspicious activity involving copies, moves, or hard-link creation (cp, mv, ln) targeting EFI boot files, or process invocations whose path includes EFI/BOOT while the process name is atypical for legitimate maintenance. By correlating process details (process_name, process_path, process_current_directory, parent process, hash, user, vendor_product, and command-line context) and aggregating first/last seen times, it raises when unexpected boot-time modifications occur. The rule is labeled under MITRE ATT&CK T1542.001 (Pre-OS Boot) and is designed to flag bootkit or firmware-level persistence attempts, which are uncommon in normal operations. False positives can arise from legitimate bootloader or firmware update activities (e.g., grub/shim updates); these should be filtered using known update processes or trusted administrative activity. In practice, this rule relies on logs from EDR-backed Linux telemetry (Sysmon for Linux EventID 1 in the provided example) and requires normalization to the Endpoint data model, with command lines preserved to provide context for triage. The detection includes drilldowns to view results by user or destination, risk-event context, and associated annotations, with the analytic storyline highlighting Linux rootkits, data destruction, and Linux persistence techniques. References and CVE/ATT&CK mappings are provided to support correlation with boot-related threats. A true-positive test is included using a dataset that simulates EFI/BOOT modifications to validate the alert.