XDG autostart desktop entry created or modified on Linux

Siemphony@siemphonylowT1547.013unverified

Matches the file half of AN1096: an auditd PATH record naming a `.desktop` file inside one of the XDG autostart directories, which is where this technique plants the `Exec=` line the desktop session runs at every login. Both conditions are required in one selection — the directory alone matches icon caches and thumbnails a desktop environment writes beside its entries, and the `.desktop` suffix alone matches every application menu entry any package installs. The two directory values are the ones MITRE names, /etc/xdg/autostart for system-wide entries and the per-user ~/.config/autostart, and the user path is matched as a fragment because the home directory differs per account; MITRE's `AutostartDirectory` knob is the warning that $XDG_CONFIG_HOME can relocate that second directory entirely, in which case this selection has to be extended with the actual value in use. Four limits are structural. auditd records the file, never its content, so MITRE's `ExecCommandPattern` knob cannot be applied here at all — a hit says an autostart entry was written, not that it points anywhere suspicious. The second half of the analytic, execution of that Exec path shortly after logon within the `TimeWindow` knob, is a cross-event correlation and lib/sigma models no timeframe and no join. The writing process's `uid` and `auid` live on the SYSCALL record rather than the PATH record, so the `UserContext` knob cannot narrow this to interactive users inside the selection. And auditd records `name=` exactly as it was handed to the syscall, so an editor run from inside the autostart directory itself logs a bare filename with no directory to match on. Prerequisite: no distribution audits these paths by default, so the rule returns zero rows until watches are loaded — `-w /etc/xdg/autostart -p wa` and a per-user `-w /home/<user>/.config/autostart -p wa`, since a home-relative path cannot be watched generically — and zero rows reads as quiet when it actually means blind. The brief's linux/osquery and linux/auth sources are not attempted, because neither has standardised Sigma field names. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0390, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (type="PATH" AND (name="*/etc/xdg/autostart/*" OR name="*/.config/autostart/*") AND name="*.desktop")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(type) == "path" AND (TO_LOWER(name) LIKE "*/etc/xdg/autostart/*" OR TO_LOWER(name) LIKE "*/.config/autostart/*") AND TO_LOWER(name) LIKE "*.desktop")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)(/etc/xdg/autostart/|/\.config/autostart/)</field>    <field name="name" type="pcre2">(?i)\.desktop$</field>    <description>XDG autostart desktop entry created or modified on Linux</description>    <mitre>      <id>T1547.013</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: low
Category: registry_persistence
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 41ad0877-ed73-4901-ba21-e1e8d4a9f730

ATT&CKT1547.013

T1547.013XDG Autostart Entries

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A .desktop file written into an XDG autostart directory on Linux. That file carries an Exec= line the desktop session runs at every login, which is the whole of this persistence technique. The rule matches the file half of AN1096 — the write itself — and nothing about what the entry points at.

02 · Telemetry you need

auditd, as product: linux / service: auditd, and specifically the PATH record. No distribution audits these paths by default, so the rule returns zero rows until you load watches: -w /etc/xdg/autostart -p wa, plus a per-user -w /home/<user>/.config/autostart -p wa, since a home-relative path cannot be watched generically. Zero rows here reads as quiet when it means blind. The brief's linux/osquery and linux/auth sources are not attempted: neither lib/sigma nor Sigma's own taxonomy carries a field map for them, so writing against either would mean inventing field names.

03 · How the logic works

One selection, three clauses, all required. type: 'PATH' pins it to the record that names the file. name|contains holds the two directories MITRE names — /etc/xdg/autostart/ for system-wide entries and /.config/autostart/ for per-user ones. The user path is matched as a fragment because the home directory differs per account; that fragment is deliberately unanchored, so it also picks up copies of a home directory in backup trees, rsync staging and container overlay roots. name|endswith: '.desktop' supplies the second half. Both halves are needed. The directory alone matches icon caches and thumbnails desktop environments write beside their entries; the suffix alone matches every application menu entry any package installs. Four things this cannot do. auditd records the file, never its content, so MITRE's ExecCommandPattern knob has nothing to bite on — a hit says an entry was written, not that it points anywhere suspicious. AN1096's second half, execution of that Exec path shortly after logon inside the TimeWindow knob, is a cross-event correlation and lib/sigma models no timeframe and no join. uid and auid live on the SYSCALL record, not PATH, so the UserContext knob cannot narrow this inside the selection. And name= is recorded exactly as handed to the syscall, so an editor run from inside the directory logs a bare filename with no directory to match.

04 · Common false positives

Package transactions dominate on a desktop fleet: applets, update notifiers, keyring and input-method daemons, Dropbox, Slack, Steam and Zoom all ship entries into /etc/xdg/autostart, so every apt, dnf, snap or flatpak operation touching one matches. A user ticking "start automatically at login" writes ~/.config/autostart/<app>.desktop, byte-for-byte the same operation the adversary performs. GNOME's and KDE's autostart editors rewrite through a temp file and a rename, so one change emits several PATH records. Ansible, Puppet or Salt pushing a standard entry matches at fleet scale.

05 · Detection maturity

tier_1: Lowest tier. Never executed against a log line, and the audit watches it depends on are ones you have to add. It stays at scaffold until you have run it, confirmed your decoder's name= format, and measured the package-install baseline it will sit on top of.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

level: low is correct and should stay there — package installs alone guarantee volume. Correlate with the package manager rather than filtering by path: a write inside a dpkg or rpm transaction window is routine, one outside it is worth a look. Two known weak points, both worth fixing before you deploy. name|endswith: '.desktop' assumes your collector strips the quotes auditd puts around name=; if it does not, that clause never matches and contains is the safer form. And XDG_CONFIG_DIRS is a list — MITRE's AutostartDirectory knob covers it alongside XDG_CONFIG_HOME — so distros adding /usr/etc/xdg or Flatpak overlays need those values added.

Declared by the author

Package installation and upgrade. Desktop software that starts with the session ships its own entry into /etc/xdg/autostart — network and printer applets, update notifiers, keyring and input-method daemons, and vendor packages such as Dropbox, Slack, Steam and Zoom — so every apt, dnf, snap or flatpak transaction touching one of them matches. On a desktop fleet this is the highest-volume match by a wide margin and is why the level is low rather than medium.
A user ticking 'start automatically at login' in an application's own preferences. Chat, sync and VPN clients write ~/.config/autostart/<app>.desktop the moment that box is ticked, which is byte-for-byte the same operation this technique performs.
Desktop environment tooling rewriting these files as designed: GNOME's Startup Applications editor, the KDE Autostart settings module and gnome-session's own migration steps rewrite entries on upgrade, and several write through a temporary file and a rename, so one intentional change emits several PATH records.
Host and account provisioning. Configuration management (Ansible, Puppet, Salt) pushing a standard autostart entry to every workstation on a recurring run, and useradd copying /etc/skel into each new home directory, both produce matching records under root at scale.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.013, evaluated against their — events.

Share this rule

/u/siemphony/41ad0877-ed73-4901-ba21-e1e8d4a9f730

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

XDG autostart desktop entry created or modified on Linux

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it