Detects creation or rename events of ELF binaries in trusted system directories by a suspicious process on Linux endpoints. The rule looks for ELF magic header bytes (0x7f 45 4c 46) in a file creation/rename event, combined with a process executable path originating from temporary or memory-backed locations and from common system directories such as /bin, /usr/bin, /lib, etc., indicating a potential attempt to install or masquerade a malicious executable in a system directory for persistence or evasion.