Adversaries may modify XDG autostart entries to execute programs or commands during system boot. Linux desktop environments that are XDG compliant implement functionality for XDG
autostart entries. These entries will allow an application to automatically start during the startup of a desktop environment after user logon. By default, XDG autostart entries
are stored within the /etc/xdg/autostart or ~/.config/autostart directories and have a .desktop file extension.[1]
Within an XDG autostart entry file, the Type key specifies if the entry is an application (type 1), link (type 2) or directory (type 3). The Name key
indicates an arbitrary name assigned by the creator and the Exec key indicates the application and command line arguments to execute.[2]
Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment. Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user. Adversaries may also use Masquerading to make XDG autostart entries look as if they are associated with legitimate programs.
| ID | Name | Description |
|---|---|---|
| S0410 | Fysbis |
Fysbis has installed itself as an autostart entry under |
| S0198 | NETWIRE |
NETWIRE can use XDG Autostart Entries to establish persistence.[4] |
| ID | Mitigation | Description |
|---|---|---|
| M1033 | Limit Software Installation |
Restrict software installation to trusted repositories only and be cautious of orphaned software packages. |
| M1022 | Restrict File and Directory Permissions |
Restrict write access to XDG autostart entries to only select privileged users. |
| M1018 | User Account Management |
Limit privileges of user accounts so only authorized privileged users can create and modify XDG autostart entries. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may modify XDG autostart entries to execute programs or commands during system boot. |
| DS0022 | File | File Creation |
Malicious XDG autostart entries may be detected by auditing file creation events within the |
| File Modification |
Malicious XDG autostart entries may be detected by auditing file modification events within the |
||
| DS0009 | Process | Process Creation |
Monitor newly executed processes that may modify XDG autostart entries to execute programs or commands during system boot. |