Identifies a Linux process that starts from a potentially suspicious writable or ephemeral path (e.g., /tmp, /var/tmp, per-user runtime paths) and that first resolves an account-specific AWS IoT Core MQTT data endpoint, then attempts an outbound TCP connection to the resolved IP on port 443 or 8883 within a short window. The rule correlates DNS lookups (dns.question.name / dns.resolved_ip) with a subsequent network connection attempt (destination.ip / destination.port) attributed to the same process (process.entity_id). This DNS-to-connection sequence is used to surface adversaries that may be using an attacker-controlled AWS IoT Core MQTT broker as a rendezvous point for command and control or data transfer, without decrypting TLS (no MQTT payload content is required). It relies on Elastic Defend network events from Linux hosts and requires collection of DNS lookup and network connection metadata, along with process context. The detection is intended to catch beacon-like behavior that uses AWS IoT endpoints, including account- and region-specific hostnames, while avoiding blanket blocks of AWS infrastructure. The rule supports investigation into how the binary or script reached the host, its persistence, any related X.509 material, and the exact AWS IoT endpoint involved. The setup notes emphasize TLS decryption is not required for this detection; TLS telemetry is recommended during investigation to confirm TLS handshakes and ALPN usage (e.g., x-amzn-mqtt-ca).