Detects a successful Linux execve event where a PID changes its executable image under the same parent after the prior image has been active for at least 1 second and no more than 60 seconds. The detection uses Linux Auditd syscall data (execve and related syscalls) to correlate process image transitions by tracking current and previous executables for the same host, PID, and parent PID. When a change from previous_exe to current_exe occurs within a 1–60 second window and the parent process remains the same, the rule flags a potential post-exploitation image change. The rule aggregates results by host, pid, ppid, previous_exe, and exe, and reports a finding that includes the destination host, new executable, and previous executable. It includes drilldown searches, a risk-oriented narrative, and links to related references. This analytic is designed to surface delayed process image changes that may indicate execution following exploitation and should be investigated alongside related endpoint and network activity. Requires auditd data ingestion and normalization to a common information model to operate effectively.