The Linux Suspicious Child Process of PostgreSQL analytic detects when a PostgreSQL process becomes the parent of a shell, interpreter, or network utility by forking a child process. This typically occurs when an attacker exploits a remote code execution vulnerability in PostgreSQL (e.g., via malicious COPY TO/FROM PROGRAM, CVE-2019-9193, or insecurely configured extensions), causing the database process to spawn attacker-controlled commands. Legitimate PostgreSQL deployments rarely fork shells or download tools, making this a high-fidelity indicator for post-exploitation activity. The detection uses Sysmon for Linux EventID 1 telemetry to examine endpoint processes and requires logs mapped to the Endpoint Processes data model. The search filters for parent_process_name values (postgres, postmaster, pg_ctl) or a parent_path of */bin/postgres and a process_current_directory matching */var/lib/postgresql/*/main*, then flags child processes with names commonly used to execute shells or utilities (awk, bash, curl, netcat, python, perl, ruby, sh, wget, etc.). When matched, the rule surfaces key fields such as parent_process_name, parent_process_path, child process_name, process, user, and destination for rapid investigation. The analytic aligns with MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) in its broad categorization of post-exploitation activity on Linux hosts. It supports threat hunting and incident response by correlating parent-child process relationships with command-line visibility. Implementation requires ingesting complete command-line executions and process GUIDs from EDR telemetry, normalizing to the CIM Endpoint:Processes model, and applying appropriate baselining to suppress known-good behavior. False positives may arise from custom PostgreSQL extensions or wrapper scripts that legitimately invoke shell utilities; mitigate by environment baselining, known-good whitelists, and throttling by destination and process_name during rollout. The rule is intended for Linux endpoints and is relevant to Linux post-exploitation, privilege escalation, and compromised host scenarios.