ParaShells root marker file write via tar compress-program script

Arnold Chan@slaz

•updated Sep 16, 2026•0•0•1

Detects execution of shell interpreters (tar, sh, bash) by the Parallels Desktop dispatcher service (prl_disp_service) or usage of compression flags containing specific markers associated with UCP/ACTOR privilege escalation patterns, specifically when executed with root privileges or by a root user.