Boot or Logon Autostart Execution: XDG Autostart Entries T1547.013

Tactics: Persistence, Privilege Escalation

Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.

Authoring guide

These 5 rules share fields, values, and exclusions.

Fields filtered most (11 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
host.os.type5eq 5
EventType4eq 2, in 2exec, exec_event, ProcessRollup2, connection_attempted, start
event.type4eq 4start, creation
process.args3eq 2, starts_with 2, in 1, wildcard 1+x, --, --restart=Never, -c, -e
Image2eq 1, is_not_null 1/bin/sh
TargetFilename2wildcard 2/boot/efi/efi/*/grub.cfg, /boot/grub/grub.cfg, /boot/grub2/grub.cfg, /etc/xdg/autostart/*, /home/*/.config/autostart-scripts/*
process_name2eq 2, in 1chmod, ctl, docker, install, kubectl
CommandLine1wildcard 1* nc *, * nc.traditional *, * ncat *
ParentImage1eq 1/usr/bin/xfce4-session
data_stream.dataset1eq 1fim.event
file.extension1in 1desktop, sh

Top indicator values (248 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
31087
EventTypein
exec
2206
EventTypein
exec_event
2150
EventTypein
start
2168
TargetFilenamewildcard
/etc/xdg/autostart/*
22
TargetFilenamewildcard
/home/*/.config/autostart-scripts/*
22
TargetFilenamewildcard
/home/*/.config/autostart/*
22
TargetFilenamewildcard
/home/*/.kde/autostart/*
22
TargetFilenamewildcard
/home/*/.kde/share/autostart/*
22
TargetFilenamewildcard
/home/*/.kde4/autostart/*
22
TargetFilenamewildcard
/home/*/.kde4/share/autostart/*
22
TargetFilenamewildcard
/home/*/.local/share/autostart/*
22
TargetFilenamewildcard
/root/.config/autostart-scripts/*
22
TargetFilenamewildcard
/root/.config/autostart/*
22
TargetFilenamewildcard
/root/.kde/autostart/*
22
TargetFilenamewildcard
/root/.kde/share/autostart/*
22
TargetFilenamewildcard
/root/.kde4/autostart/*
22
TargetFilenamewildcard
/root/.kde4/share/autostart/*
22
TargetFilenamewildcard
/root/.local/share/autostart/*
22
TargetFilenamewildcard
/usr/share/autostart/*
22
CommandLinewildcard
* nc *
17
CommandLinewildcard
* nc.traditional *
1
CommandLinewildcard
* ncat *
12
CommandLinewildcard
* netcat *
12
CommandLinewildcard
*./.*
12
CommandLinewildcard
*/boot/*
1
CommandLinewildcard
*/dev/shm/*
19
CommandLinewildcard
*/dev/tcp/*
15
CommandLinewildcard
*/etc/init.d*
14
CommandLinewildcard
*/etc/ld.so*
14

Exclusions (89 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
process_namein
remmina
2
CommandLinein
chmod 755 /etc/update-motd.d/
1
CommandLinein
chmod 777 /etc/update-motd.d/
1
Imagein
/opt/google/chrome/chrome
1
Imagein
/sbin/mkhomedir_helper
1
Imagein
/usr/bin/crio
1
Imagein
/usr/bin/dnf5
1
Imagein
/usr/bin/nextcloud
1
Imagein
/usr/bin/pamac-daemon
1
Imagein
/usr/bin/sealert
1
Imagein
/usr/libexec/platform-python
1
Imagein
/usr/libexec/xdg-desktop-portal
1
Imagein
/usr/sbin/gdm
1
Imagein
/usr/sbin/mkhomedir_helper
1
Imagein
/usr/sbin/sshd
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint

Elastic 5 rules