Post-exploitation persistence via Screen Sharing file-copy root primitive

Duo Tech@duotech

•updated Aug 17, 2026•5•0•29

Detects creation of LaunchAgent/LaunchDaemon plists, /etc/zshenv, or SSH authorized_keys attributed to screensharingd/helpers or occurring within a Screen Sharing session window — persistence via the root file-write primitive.