Identifies a Linux ELF file created or renamed in writable, transient directories (e.g., temporary, shared-memory, runtime, mail, or web paths) by a transfer utility, file manipulation tool, interpreter, or executable running from an unusual location. This pattern is consistent with an adversary staging a Linux payload for subsequent execution. Implemented as an EQL rule over logs-endpoint.events.file*, it looks for Linux hosts where an ELF file is created or renamed (file.Ext.header_bytes matches the ELF magic 7f 45 4c 46) and the initiating process is either a known download/staging utility (curl, wget, ftp, tftp, scp, rsync, busybox, timeout, env, cp, mv, install, dd, tee, touch, tar, gzip, gunzip, bzip2, bunzip2, xz, unxz, zip, unzip, 7z, bun) or a process executing from unusual directories (e.g., /tmp, /var/tmp, /dev/shm, /run, /var/run, /boot, /sys, various web directories, memfd, or similar) and where the file path also resides in similar suspicious locations. The query also considers broader command-language and executable-path indicators to catch diverse staging workflows. The rule is mapped to MITRE ATT&CK technique T1105 (Ingress Tool Transfer) under Command and Control. The detection relies on Elastic Defend data; enabling linux.advanced.events.populate_file_data in the Elastic Agent policy ensures the required file.Ext.* fields are populated for accurate matching. This rule aids investigators in identifying potential payload staging and should be correlated with network indicators, file hashes, and process lineage for containment and remediation.