This rule detects the first observed Memcached store command from any client to a Memcached server within a seven-day new-terms window, flagging potential unauthorized writes. It monitors Memcached store operations (set, add, replace, append, prepend, cas) and flags a successful operation or a noreply scenario, highlighting an unusual writer relationship. Because Memcached typically lacks authentication, such first-time writes can overwrite session tokens, poison cached content, or alter security-sensitive state, enabling session hijacking as described by CVE-2026-29093. The rule uses the logs-network_traffic.memcached dataset and requires an Elastic Network Packet Capture integration with the Memcached protocol analyzer to observe client-to-server transactions with visible metadata (but not cached values). It does not prove a hijack; it surfaces new client/server/write relationships for application-context investigation. The rule maps to MITRE ATT&CK: Data Manipulation (T1565), Stored Data Manipulation (T1565.001). Investigation should examine client/server roles, keys (without exposing values), and contextual history of prior activity, as well as any follow-on actions like flush or privileged sessions. Remediation guidance includes blocking unauthorized clients, restricting Memcached access to trusted networks, rotating exposed credentials if manipulation is suspected, and binding Memcached to private interfaces with strict network controls.