Techniques
Sample rules
Linux Suspicious XDG Autostart
- source: splunk
- technicques:
Description
The following analytic detects the creation of a .desktop file within XDG autostart directories, including the system-wide /etc/xdg/autostart and user-local ~/.config/autostart paths. Adversaries abuse XDG autostart entries to achieve persistence on Linux desktop environments — any .desktop file placed in these directories is automatically executed when a user logs into a graphical session. This technique is used by post-exploitation frameworks such as PANIX to survive reboots without requiring root on user-local paths, or to achieve system-wide persistence when writing to /etc/xdg/autostart.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime max(_time) as lastTime
FROM datamodel=Endpoint.Filesystem WHERE
Filesystem.action="created"
Filesystem.file_path IN (
"/etc/xdg/autostart/*",
"*/.config/autostart/*"
)
Filesystem.file_path = "*.desktop"
BY Filesystem.action Filesystem.dest Filesystem.file_access_time
Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
Filesystem.file_name Filesystem.file_path Filesystem.process_guid
Filesystem.process_id Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_suspicious_xdg_autostart_filter`