On Linux desktops, many programs start at login because of small text files. MITRE tracks the abuse of that mechanism as T1547.013, XDG Autostart Entries, with Persistence and Privilege Escalation as the tactics and Linux as the platform.
How attackers use it
XDG Autostart entries are available on any XDG-compliant Linux system. They use Desktop Entry files, with the .desktop extension, to configure the desktop environment at login. These files determine which applications launch, which applications open particular file types, and which handle removable media.
MITRE describes the abuse: an adversary adds a path to a malicious binary or command in the Exec directive of a .desktop file. When the user's desktop environment loads, the files in the autostart directories run automatically.
Two locations matter.
/etc/xdg/autostartfor system-wide entries.~/.config/autostartfor per-user entries.
Entries can be combined with Masquerading so a malicious item blends in with legitimate programs.
How to detect it
MITRE's detection strategy correlates file creation or modification of .desktop files in the XDG autostart directories with execution of processes at login started by the desktop environment. The telling features are suspicious Exec paths, anomalous names, and entries that are not tied to an installed package.
A file integrity or audit rule on both directories is the simplest base. Alert on writes from anything other than your package manager or a configuration management run.
How to reduce the risk
MITRE lists three mitigations.
- Limit Software Installation: restrict installs to trusted repositories and be cautious of orphaned software packages.
- Restrict File and Directory Permissions: limit write access to autostart entries to select privileged users.
- User Account Management: only authorized privileged users should create or modify these entries.
Check your own environment
Read-only commands for a Linux shell.
ls -la /etc/xdg/autostart ~/.config/autostart
grep -H '^Exec=' /etc/xdg/autostart/*.desktop ~/.config/autostart/*.desktop
To see whether a system entry belongs to an installed package, ask the package manager. On Debian based systems use dpkg -S /etc/xdg/autostart/<file>, and on RPM based systems use rpm -qf /etc/xdg/autostart/<file>. An entry that no package owns deserves an explanation.
Quick check
Which directive in a desktop file holds the command to run?
The Exec directive.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: XDG Autostart Entries: https://attack.mitre.org/techniques/T1547/013
