ParaShells: tar extraction spawned as child of prl_disp_service

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•2

Detects suspicious execution of the 'tar' utility spawned by 'prl_disp_service' (Parallels Desktop service) using potentially malicious command-line arguments. The rule specifically flags the use of '--use-compress-program' or the inclusion of double quotes in the command line, which are often used to achieve arbitrary code execution via shell injection in this context.