This rule detects Linux privilege escalation via the execve syscall (syscall 59) when a process transitions from a non-root UID to euid=0 without a corresponding successful PAM authentication event (USER_AUTH, USER_ACCT, or CRED_ACQ) in the same audit session. Legitimate elevation mechanisms such as sudo, su, and pkexec authenticate through PAM and emit authentication records tied to the session before granting elevated privileges. The absence of a matching successful PAM event alongside an effective UID change to root is anomalous and may indicate exploitation of a setuid binary, a kernel vulnerability, or another mechanism bypassing normal authentication. Implementation ingests Linux auditd data (including SYSCALL, TYPE, EXECVE, and PROCTITLE events) via the Splunk Add-on for Unix and Linux, normalizes fields to Splunk CIM conventions, and correlates events across the session. The search flags suspicious execve events where uid != 0 and euid = 0, and checks for any successful PAM authentication in the same session. Results include process details (process_name, process_path, pid, ppid), identity context (uid, euid), and timing (firstTime, lastTime) grouped by host and session. The rule flags sessions where an executable run with root privileges occurred without verified PAM authentication, enabling investigators to drill down into potential setuid abuse, kernel bypasses, or alternate privilege escalation paths. This rule is tagged with MITRE ATT&CK technique T1068 (Privilege Escalation) and references CVE-2026-46331. It supports an incident-focused analytic story around Linux Privilege Escalation, with intermediate findings and risk-oriented drilldowns. False positives may arise from legitimate privilege changes in cron jobs or processes that drop or re-establish root privileges outside PAM authentication, and may require filtering. The detection supports Splunk Enterprise, Splunk ES, and Splunk Cloud deployments and targets endpoint Linux hosts.