Arnold Chan
@slazTrusted contributorCompletionist
2 followers2,100 downloads4,388 copies51 likes26,186 views
7,555 detections
Filters
Last updated
All Time
Detection languages
5,650
1,006
394
169
98
Categories
2,356
1,807
1,233
1,013
924
Platforms
4,191
1,622
1,250
676
676
Products / Services
2,820
1,003
991
720
485
MITRE Techniques
2,087
1,520
1,413
1,070
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
This rule detects unauthorized modifications to the /etc/sudoers.d/ directory, specifically identifying files with a 'prl-rce-' naming pattern that contain 'NOPASSWD:ALL'. This configuration allows users to execute commands with elevated privileges (root) without requiring a password, which is a common technique used by attackers to maintain persistence and facilitate privilege escalation on Linux systems.
Detects unauthorized or non-privileged processes attempting to communicate with the Parallels Desktop IPC Unix socket (prl_disp_service.socket). This behavior is indicative of exploitation attempts targeting the ParaShells vulnerability (CVE-2026-90894), where an unprivileged user can leverage the socket's lack of proper signature or identity verification to escalate privileges.
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Detects execution of the tar utility by the prl_disp_service process with a command line pattern indicative of command injection via the --use-compress-program flag. This technique is often used to execute arbitrary commands by embedding them within the compression program argument.
Detects instances where the Parallels dispatcher service (prl_disp_service) is invoked to install an appliance using a local 'file:///tmp/' URL instead of a trusted remote catalog source, which may indicate an attempt to load unauthorized or malicious virtual appliance files.
Detects instances where the Parallels dispatcher service (prl_disp_service) is invoked to install an appliance using a local 'file:///tmp/' URL instead of a trusted remote catalog source, which may indicate an attempt to load unauthorized or malicious virtual appliance files.
Detects network connections to known FLATROOF and ROOFDECK C2 infrastructure used by Jade Sleet/TraderTraitor (UNC4899, Lazarus) in campaigns targeting IT services and DevOps engineers.
Detects network connections to known FLATROOF and ROOFDECK C2 infrastructure used by Jade Sleet/TraderTraitor (UNC4899, Lazarus) in campaigns targeting IT services and DevOps engineers.
Page 397 of 756