This Linux endpoint rule detects when a web server process writes a file whose name blends a web-executable suffix with a misleading non-web extension (e.g., shell.php.jpg). It uses EQL to correlate process and file events: the creating process must be a Linux web server or interpreter (nginx, apache2/httpd, php-cgi, node, python, etc.), and the file name must contain web-like extensions while the actual extension is non-web (jpg, zip, sh, elf, etc.). The query filters out deletions and focuses on writes by web servers to serve or execute content, which is a common tactic for web shells, obfuscated payloads, or bypassing upload controls. MITRE ATT&CK mappings include Web Shell (T1505.003) under Persistence, Exploit Public-Facing Application (T1190) under Initial Access, and Exploitation of Remote Services (T1210) under Lateral Movement. The rule is configured for Elastic Defend integration on Linux endpoints and assigns a high risk score (73). Investigation context should verify the file path, ownership, permissions, timestamps, cryptographic hash, MIME type, and magic bytes; assess web server configuration to determine if the file is web-accessible or executable; correlate with HTTP/app/proxy logs to identify the originating request; examine process lineage and any follow-on activity (shells, interpreters, outbound connections, privilege escalation, or persistence changes); and preserve evidence if malicious activity is confirmed. False positives can arise from legitimate content-management or deployment workflows that use similarly named files (e.g., template.php.jpg, page.jsp.zip); verify MIME type, expected behavior, and destination executability before acting. Remediation guidance includes isolating the host, removing the suspicious file and related web shells, rotating credentials, patching, and enforcing strict upload validation and directory permissions to prevent recurrence.