tfMITRE ATT&CK sub-technique

XDG Autostart Entries T1547.013

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: Linux
Version: 1.2
Created: 10 September 2019
Last modified: 24 October 2025
Contributor: Tony Lambert, Red Canary

Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (.desktop) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

XDG Autostart Entries MITRE reference T1547.013

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Contagious InterviewG1052 ↗

Has established persistence using InvisibleFerret malware to create a .desktop entry to run on startup on GNOME-based Linux devices.1

created 2025-10-191 referenceaka DeceptiveDevelopment

All 1 groups for this technique

6 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

InvisibleFerretS1245 ↗

Has established persistence within GNOME-based Linux environments by placing entries within .desktop that run on Startup.1

created 2025-10-17MALWAREcarried by 1 group

RotaJakiroS1078 ↗

When executing with user-level permissions, RotaJakiro can install persistence using a .desktop file under the $HOME/.config/autostart/ folder.1

created 2023-06-14MALWAREcarried by 1 group

FysbisS0410 ↗

If executing without root privileges, Fysbis adds a .desktop configuration file to the user's ~/.config/autostart directory.1 2

created 2019-09-12MALWAREcarried by 1 group

CrossRATS0235 ↗

Can use an XDG Autostart to establish persistence.1

created 2018-10-17MALWAREcarried by 1 group

NETWIRES0198 ↗

Can use XDG Autostart Entries to establish persistence on Linux systems.1

created 2018-04-18MALWAREcarried by 4 groups

PupyS0192 ↗

Can use an XDG Autostart to establish persistence.1

created 2018-04-18TOOLcarried by 2 groups

All 6 software entries for this technique

Offense vs defense T1547.013

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

XDG Autostart Entries detection strategy DET0390

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Linux Detection Strategy for T1547.013 - XDG Autostart Entries

Enterprise

1 platform

AN1096 · Linux

Correlation of file creation/modification of .desktop files within XDG autostart directories, followed by execution of processes at user login initiated by the desktop environment. Malicious entries typically include suspicious Exec paths or anomalous names and are not associated with installed packages.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	Process execution via .desktop Exec path from /etc/xdg/autostart or ~/.config/autostart
File CreationDC0039	auditd:SYSCALL	creat
File AccessDC0055	auditd:SYSCALL	open
File MetadataDC0059	linux:osquery	Write or modify .desktop file in XDG autostart path
Logon Session CreationDC0067	linux:auth	User login event followed by unexpected process tree

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecCommandPattern	Regex or allowlist of expected Exec paths within .desktop files. Deviations may be suspicious.
AutostartDirectory	May vary by user config (e.g., $XDG_CONFIG_HOME). Must enumerate actual values per system.
TimeWindow	Correlate file creation/mod + exec within login window (e.g., 0–5 min of user logon).
UserContext	Should filter to non-system users, as XDG persistence typically targets interactive sessions.
PackageOriginBaseline	Compare .desktop entries to known package sources (e.g., `dpkg -S`). Unexpected origins may be suspicious.

XDG Autostart Entries detections T1547.013

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs