Detects an OpenSSL-based operation on Linux that either (a) generates a certificate with CN=LinuxTransport and posts it to WireServer, or (b) decrypts CMS/PKCS7 payloads using a non-waagent key to unwrap protectedSettings. Adversaries can scrape WireServer certificates, mint a LinuxTransport identity, and decrypt extension-protectedSettings. The rule targets Linux processes starting OpenSSL with specific arguments and excludes legitimate Azure Linux Agent activity by path and parent process, but can still trigger when attackers run commands via Run Command or other non-waagent parents. Investigative signals include openssl commands with cms/smime and -decrypt, or openssl req -x509 with LinuxTransport subject, combined with arguments that reference non-waagent keys (e.g., wireserver.key, temp.key) and the absence of the waagent path. Correlate with network activity to WireServer endpoints and search for key material or decrypted payloads on disk. Recommended follow-ups include isolating the host, rotating/decrypting secrets in protectedSettings, rotating managed identities, and revoking any SAS tokens that may have been exposed.