This Linux endpoint anomaly detects suspicious Docker build activity targeting Dockerfiles located in the /tmp directory. Running docker build in /tmp is atypical in production and can indicate an actor staging a container image for later malicious use. The rule triggers when a process name contains docker and build is observed, and the associated command line or working directory indicates a Dockerfile reference or execution from /tmp (e.g., a -f <path> to a file under /tmp or a current directory of /tmp). It leverages the Splunk Endpoint data model (Endpoint.Processes) to correlate rich context: Processes.process, vendor_product, user_id, process_hash, parent_process_name, parent_process_exec, action, dest, process_current_directory, process_path, process_integrity_level, original_file_name, parent_process, parent_process_path, parent_process_guid, parent_process_id, process_guid, process_id, user, and process_name. The result is labeled with linux_suspicious_docker_build_command_execution_filter to facilitate correlation and alerting. The detection is categorized under Linux Post-Exploitation and mapped to MITRE ATT&CK T1610. It supports investigative drilldowns (per-user and per-destination views) and a 7-day risk view, and includes a True Positive test dataset based on Sysmon/Linux telemetry. Known false positives include legitimate /tmp testing by developers or admins, which can be mitigated by filtering on known users or systems. Overall, this rule aims to identify a potential staging step for container usage by signaling Docker build activity in an unusual directory on Linux endpoints, enabling rapid containment and investigation.