Techniques › T1547.013 › AN1096
AN1096 Analytic 1096
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Correlation of file creation/modification of
.desktop files within XDG autostart directories, followed by execution of processes at user login initiated by the desktop environment. Malicious entries typically include suspicious Exec paths or anomalous names and are not associated with installed packages.</p>- Detects
- T1547.013 XDG Autostart Entries
- Part of
- DET0390 Linux Detection Strategy for T1547.013 - XDG Autostart Entries
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | creat | DC0039 File Creation |
| auditd:SYSCALL | open | DC0055 File Access |
| auditd:EXECVE | Process execution via .desktop Exec path from /etc/xdg/autostart or ~/.config/autostart | DC0032 Process Creation |
| linux:osquery | Write or modify .desktop file in XDG autostart path | DC0059 File Metadata |
| linux:auth | User login event followed by unexpected process tree | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ExecCommandPattern | Regex or allowlist of expected Exec paths within .desktop files. Deviations may be suspicious. |
AutostartDirectory | May vary by user config (e.g., $XDG_CONFIG_HOME). Must enumerate actual values per system. |
TimeWindow | Correlate file creation/mod + exec within login window (e.g., 0–5 min of user logon). |
UserContext | Should filter to non-system users, as XDG persistence typically targets interactive sessions. |
PackageOriginBaseline | Compare .desktop entries to known package sources (e.g., `dpkg -S`). Unexpected origins may be suspicious. |