Detects creation of Linux binfmt configuration files that modify the kernel's execution behavior. The rule watches for file creation events in common binfmt configuration locations (for example /etc/binfmt.d/*.conf, /run/binfmt.d/*.conf, /usr/local/lib/binfmt.d/*.conf, /usr/lib/binfmt.d/*.conf) and for writes to the binfmt_misc interfaces (/proc/sys/fs/binfmt_misc/register and /proc/sys/fs/binfmt_misc/*). It requires a non-deletion action, a non-null process.executable, and a file path match. It excludes known benign or default configurations (e.g., python3/qemu-*-static.conf) and when the triggering process is systemd-binfmt, reducing false positives. Creation of binfmt config files can be used by attackers to persist by enabling execution of backdoors or chained commands via crafted interpreters or scripts. This aligns with MITRE ATT&CK technique T1546 (Event Triggered Execution) under Persistence. The rule is reported via the logs-endpoint.events.file* index, with event.ingested timestamp, and is intended for Linux endpoints protected by Elastic Defend.