← Back to Explore
T1547.013
XDG Autostart Entries
Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define application...
Linux
5
Detections
1
Sources
1
Threat Actors
BY SOURCE
5elastic
PROCEDURES (3)
Process Creation Monitoring3 detections
Auto-extracted: 3 detections for process creation monitoring
Network Connection Monitoring1 detections
Auto-extracted: 1 detections for network connection monitoring
File Monitoring1 detections
Auto-extracted: 1 detections for file monitoring
THREAT ACTORS (1)
DETECTIONS (5)
Executable Bit Set for Potential Persistence Script
elasticmedium
KDE AutoStart Script or Desktop File Creation
elasticmedium
Network Connections Initiated Through XDG Autostart Entry
elasticmedium
Pod or Container Creation with Suspicious Command-Line
elasticmedium
Potential Persistence via File Modification
elasticlow