ParaShells Root LaunchDaemon/Agent plist created after prl_disp_service tar exploit
Detects a suspicious sequence of events where the Parallels Desktop dispatcher service (prl_disp_service) executes a tar command with a compression program flag, followed immediately by the creation or modification of a launch agent (.plist) file in system or user launch directories. This pattern is indicative of exploitation or post-exploitation activity attempting to achieve persistence.
Microsoft Sentinel (KQL)
