Technical summary: This rule detects the creation or modification of a PHP file in the WordPress plugin directory on Linux endpoints. It watches for Linux host events where event.type is creation or change and where the file path matches */wp-content/plugins/*.php*. It also checks that the initiating process is one commonly used by web servers, PHP runtimes, or scripting tools (e.g., nginx, apache2/httpd, php-cgi, php-fpm, wget, curl, shells such as bash/sh/ksh, and CGI/FCGI patterns). When such a PHP file is touched within the WordPress plugins directory, the rule flags it as a possible web shell injection used to gain persistence and potential remote access. The rule is mapped to MITRE ATT&CK techniques: T1505 Web Shell (subtechnique T1505.003) for persistence via a compromised web server, T1190 Exploit Public-Facing Application for initial access, and T1059 Command and Scripting Interpreter for execution via shell/interpreter processes. The rule relies on Elastic Defend data collected by Fleet from Linux endpoints and uses endpoint file and process events. False positives may occur during legitimate maintenance or plugin updates, so baselining and context-aware tuning are recommended.