T1547.013 — XDG Autostart Entries

Tactics: Persistence, Privilege Escalation · Platforms: Linux

Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries

title: "T1547.013 Boot or Logon Autostart Execution: XDG Autostart Entries"
id: c40c7230-3760-4e64-8495-9ed798a9dd26
description: 'Linux Detection Strategy for T1547.013 - XDG Autostart Entries. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecCommandPattern, AutostartDirectory, TimeWindow, UserContext, PackageOriginBaseline.'
references:
  - https://attack.mitre.org/techniques/T1547/013
author: Shahrukh Khan
date: 2026-02-17
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.013

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/etc/xdg/autostart/'
      - '/.config/autostart/'
    name|endswith: '.desktop'

  condition: selection

falsepositives:
  - Legitimate desktop application installers registering autostart entries; scope AutostartDirectory to unexpected users/system-wide locations and PackageOriginBaseline to unverified sources.

level: medium

Related sub-techniques

Explore