ParaShells: sudoers.d NOPASSWD rule written via prl-rce artifact

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•2

This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.