Privilege Escalation via Parallels Appliance Extract Argument Injection

 1[metadata]
 2creation_date = "2026/09/17"
 3integration = ["endpoint"]
 4maturity = "production"
 5updated_date = "2026/09/17"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies the Parallels Desktop root dispatcher (prl_disp_service) spawning tar/bsdtar with more arguments than its fixed extract command uses. 
11The dispatcher always runs a 5-token command (tar -xf <archive> -C <dir>), so any additional arguments indicate an attacker-controlled folder name injecting extra tar flags. 
12On macOS these flags let tar read or write attacker-chosen paths or execute an external program as root, resulting in local privilege escalation (CVE-2026-90894, Parallels Desktop < 27.0.0).
13"""
14from = "now-9m"
15language = "esql"
16license = "Elastic License v2"
17name = "Privilege Escalation via Parallels Appliance Extract Argument Injection"
18note = """## Triage and analysis
19
20### Investigating Privilege Escalation via Parallels Appliance Extract Argument Injection
21
22Parallels Desktop runs prl_disp_service as root and exposes a world-writable socket that any local account can
23reach without admin rights. On builds before 27.0.0 the appliance-install path re-tokenizes a tar command
24string, letting an attacker-controlled folder name inject additional tar flags. A --use-compress-program value
25pointing at an attacker-writable path (commonly /tmp) is executed as root.
26
27- Review process.args for the injected flag and the program it points to; a path under /tmp, /var/tmp, or a
28user-writable location is a strong signal of exploitation.
29- Inspect the child process the injected program spawned (parent tar/bsdtar, running as root) and any files it
30created or modified.
31- Confirm the host's Parallels version; builds on the 26.x line remain affected.
32
33### Response and remediation
34
35- Isolate the host and terminate the injected program and any root children it spawned.
36- Upgrade Parallels Desktop to 27.0.0 or later; on hosts still on 26.x, restrict local login as an interim
37control since any local account can reach the dispatcher socket.
38"""
39references = [
40    "https://research.jfrog.com/vulnerabilities/parallels-desktop-is-vulnerable-to-a-local-privilege-escalation-via-appliance-extract-argument-injection-cve-2026-90894/",
41    "https://www.cve.org/CVERecord?id=CVE-2026-90894",
42]
43risk_score = 73
44rule_id = "448dbe05-07b1-46bb-b3e3-ac9790387948"
45severity = "high"
46tags = [
47    "Domain: Endpoint",
48    "Platform: macOS",
49    "OS: macOS",
50    "Rule Type: ESQL",
51    "Use Case: Threat Detection",
52    "Tactic: Privilege Escalation",
53    "Tactic: Defense Evasion",
54    "Data Source: Elastic Defend",
55    "Vuln: CVE-2026-90894",
56    "Resources: Investigation Guide",
57    "Use Case: Vulnerability",
58]
59timestamp_override = "event.ingested"
60type = "esql"
61
62query = '''
63FROM logs-endpoint.events.process-* METADATA _id, _index, _version
64| WHERE host.os.type == "macos"
65    AND process.parent.name == "prl_disp_service"
66    AND process.name IN ("tar", "bsdtar")
67    AND process.args_count > 5
68    AND KQL("""process.args : "-xf" AND event.type : "start" """)
69| EVAL process_args_joined = MV_CONCAT(process.args, " ")
70| KEEP _id, _index, _version, @timestamp, data_stream.namespace, host.id, host.name, user.id, user.name,
71    process.entity_id, process.parent.name, process.parent.entity_id, process.name, process.executable,
72    process.args_count, process_args_joined
73'''
74
75[[rule.threat]]
76framework = "MITRE ATT&CK"
77
78[[rule.threat.technique]]
79id = "T1068"
80name = "Exploitation for Privilege Escalation"
81reference = "https://attack.mitre.org/techniques/T1068/"
82
83[rule.threat.tactic]
84id = "TA0004"
85name = "Privilege Escalation"
86reference = "https://attack.mitre.org/tactics/TA0004/"
87
88[[rule.threat]]
89framework = "MITRE ATT&CK"
90
91[[rule.threat.technique]]
92id = "T1202"
93name = "Indirect Command Execution"
94reference = "https://attack.mitre.org/techniques/T1202/"
95
96[rule.threat.tactic]
97id = "TA0005"
98name = "Defense Evasion"
99reference = "https://attack.mitre.org/tactics/TA0005/"