The rule detects a defense evasion pattern where a Linux process is started from an ephemeral or in-memory location and is immediately followed by a deletion event to remove traces. Implemented in Elastic Query Language (EQL), it sequences a Linux process start (event.type: start, event.action: exec) with a process.executable that matches common temporary or memory-backed paths (e.g., /tmp, /var/tmp, /dev/shm, /run, /var/run, /proc/*/fd, memfd:*). Within 30 seconds, a file deletion event is observed (event.action: deletion) for a file at file.path. This combination indicates an attacker executing a payload from a non-persistent location and attempting to erase evidence shortly after. The rule leverages two data sources: logs-endpoint.events.process* and logs-endpoint.events.file*, and maps to MITRE ATT&CK Defense Evasion techniques: T1070 (Indicator Removal) with subtechnique T1070.004 (File Deletion). It targets Linux-based endpoints and is intended for Elastic Defend deployments via Elastic Agent with Fleet, providing a moderate risk signal (risk_score: 47). The included setup guidance details prerequisites for enabling Elastic Defend integration, Fleet, and agent policies to support the rule’s data collection. Alerts triggered by this rule may indicate malware, post-exploitation tooling, or APT activity attempting to hide activity by deleting files after execution.