This rule detects Linux web server processes that create files with script or executable extensions while the file header bytes indicate a different format, enabling polyglot or bypass techniques. It targets endpoint activity by inspecting logs-endpoint.events.file* for file creation events on Linux hosts, excluding deletions. The rule flags creation by web server-related processes (e.g., nginx, apache2, httpd, php-cgi, uwsgi, etc.) when the declared extension (php, jsp, py, elf, etc.) mismatches the actual file type as indicated by header_bytes. It leverages Elastic Defend data (linux.advanced.events.populate_file_data) to populate file.Ext.* fields (extension and header bytes) and compares declared extension, detected type, and full contents to identify appended server-side code, embedded executables, obfuscation, or multi-format artifacts. The detection includes various executable and script extensions and checks for headers such as JPEG, PNG, GIF, ELF, PDF, and others to identify polyglot content. MITRE ATT&CK mappings include Web Shell under Persistence (TA0003 / T1505.003), Exploit Public-Facing Application under Initial Access (TA0001 / T1190), and Exploitation of Remote Services under Lateral Movement (TA001 / T1210). The rule requires Elastic Defend integration configured via Fleet, and specifically the linux.advanced.events.populate_file_data setting must be enabled to populate file data fields for accurate detection. The query targets Linux hosts with file creation events and non-deletion actions, bounded by a defined set of web server processes and extension/header mismatches. It is evaluated as high severity with a risk score of 73, and provides remediation guidance including isolating affected hosts, quarantining artifacts, validating complete file content, and hardening upload validation to prevent recurrence.