This rule detects when commonly targeted Linux system binaries are created or overwritten, which adversaries may abuse to install backdoors, harvest credentials, or maintain persistence while appearing to use legitimate tools. Targeted binaries include /usr/bin/cat, /usr/bin/cp, /usr/bin/ls, /usr/bin/lsof, /usr/bin/mv, /usr/bin/netstat, /usr/bin/ps, and /usr/bin/ss. The detection relies on Sysmon for Linux EventID 11 (File Created) ingested into the Endpoint Filesystem data model and normalized via Splunk CIM. The search analyzes file_path events for the listed binaries, capturing who created/overwrote the file, the destination host, the action, and the creating process. It then applies a dedicated linux_possible_system_binary_backdoor_filter to identify likely backdoor activity, producing an intermediate finding that highlights the affected host, the binary, and the creating user. The incident is associated with Linux post-exploitation and persistence techniques, including Masquerading (T1036) and Unix shell activity (T1059.004). Known false positives include legitimate system updates or package-management operations that replace binaries; these should be filtered by excluding known update processes. The rule is designed for endpoint telemetry and CIM-normalized data and should be mapped to the Filesystem datamodel with proper field normalization. References include PANIX as a source of inspiration. The detection can be drilled down by user/destination for audit, and by risk/events to view related risk signals over time.