ParaShells: tar --use-compress-program spawned by prl_disp_service as root
Detects the use of the 'tar' utility with the '--use-compress-program' flag, where the compression program specified is not a standard system compression tool. This pattern is commonly used by attackers to execute arbitrary payloads when tar extracts malicious archives.
Microsoft Sentinel (KQL)
