This rule detects suspicious Redis-driven activity on Linux hosts by identifying Redis processes that spawn system shell commands. It targets child processes that may indicate exploitation of a Redis server to gain code execution or persistence. The detection focuses on scenarios where a Redis server or sentinel process (or a Redis binary path) launches common interpretation or scripting tools (e.g., bash, python, perl, lua, nc, curl, wget, etc.). By correlating parent process information (redis-server/redis-sentinel or /bin/redis* paths) with the spawned process names and their command lines, the analytic aims to surface post-exploitation behavior that leverages Redis as a foothold or persistence mechanism on the host. The search builds on the Endpoint.Processes data model (CIM-normalized) and requires full command-line visibility and process GUIDs from a Linux EDR/EDR-like telemetry feed. The rule is reinforced with drop-down and time-based formatting functions to produce concise fields for investigation. Potential false positives include legitimate administrative or maintenance tasks that interact with Redis; tuning and whitelisting of known admin tooling are recommended. Operational notes emphasize ingestion from Linux Sysmon-like telemetry (EventID 1) and the need to map logs to the Processes node, normalize fields, and use CIM to speed up data modeling. The rule aligns with Linux post-exploitation, living-off-the-land, and Linux-privilege/escalation TTPs, and references CVE-2022-0543 as a related exposure.MITRE mapping included: T1505 (Server/Service) and T1210 (Exploitation of remote services). The drilldown and risk views support targeted investigation of the specific host and user/destination, with an associated test dataset illustrating a true-positive scenario for Linux hosts running Redis-related services.