Screen Sharing sudoers.d write by screensharingd leads to fast passwordless sudo callback

Duo Tech@duotech

•updated Aug 17, 2026•1•0•16

Detects sudoers.d writes attributed to screensharingd/helper followed within minutes by passwordless (sudo -n) execution for a previously-unprivileged account, optionally correlated with a dropped callback script.