XDG Autostart Entries
XDG Autostart Entries [T1547.013]
Information
Name: XDG Autostart Entries
ID: T1547.013
Technique: T1547
Introduction
XDG Autostart Entries (T1547.013) is a sub-technique within the MITRE ATT&CK framework under the broader persistence category, specifically focusing on Linux-based systems. Attackers leverage this method by placing malicious scripts or executables within autostart directories defined by the X Desktop Group (XDG) specification. These entries ensure that the malicious payload executes automatically upon user login or desktop environment startup, allowing attackers to maintain persistence and continuous access to compromised systems.
Deep Dive Into Technique
XDG Autostart Entries rely on the standardized XDG Base Directory Specification, widely adopted by Linux desktop environments, including GNOME, KDE, XFCE, and others. Attackers exploit this mechanism by creating specially crafted ".desktop" files within autostart directories, typically located at:
User-specific autostart directory:
~/.config/autostart/System-wide autostart directory:
/etc/xdg/autostart/
These ".desktop" files contain key-value pairs defining application parameters, execution commands, and metadata. A typical malicious ".desktop" file might look like:
Attackers often disguise malicious entries by naming them similarly to legitimate system processes or common utilities to evade suspicion. The entry executes automatically upon graphical user interface login, granting attackers persistent and stealthy access.
Furthermore, attackers may use scripts or binaries executed through these entries to:
Establish reverse shells or backdoors.
Initiate keyloggers to capture sensitive information.
Execute privilege escalation attempts or lateral movement.
Perform reconnaissance and data exfiltration.
When this Technique is Usually Used
Attackers commonly deploy XDG Autostart Entries during the persistence phase of an intrusion. Typical scenarios and stages include:
Post-exploitation persistence: After initial compromise through phishing, exploitation of vulnerabilities, or stolen credentials, attackers establish autostart entries to maintain access.
Privilege escalation follow-up: After gaining elevated privileges, attackers utilize autostart entries to ensure continued privileged execution.
Insider threat scenarios: Malicious insiders may deploy autostart entries to maintain covert access to resources without detection.
Targeted attacks and APT campaigns: Advanced Persistent Threat groups frequently leverage this technique to maintain long-term stealthy persistence in targeted Linux environments.
How this Technique is Usually Detected
Detection of XDG Autostart Entries involves multiple approaches, including:
File Integrity Monitoring (FIM):
Tools like AIDE, Tripwire, or OSSEC can detect unauthorized changes or creation of new ".desktop" files within autostart directories.
Endpoint Detection and Response (EDR):
Modern EDR solutions can monitor filesystem activities and detect suspicious file creations or modifications in autostart directories.
Manual inspection and auditing:
Regularly checking contents of
~/.config/autostart/and/etc/xdg/autostart/directories for unknown or suspicious entries.
Behavioral analysis and anomaly detection:
Monitoring login scripts or startup processes for anomalous behavior or unusual execution patterns.
Log monitoring and SIEM correlation:
Centralized logging and SIEM solutions (Splunk, Elastic Stack, QRadar) can correlate filesystem modifications with other suspicious activities.
Specific Indicators of Compromise (IoCs):
Presence of unknown or suspicious ".desktop" files with unusual names or execution paths.
Unusual executables or scripts referenced in the "Exec" field of ".desktop" files.
Unexpected outbound network connections initiated shortly after user login.
Why it is Important to Detect This Technique
Early detection of malicious XDG Autostart Entries is crucial due to several potential severe impacts:
Persistent unauthorized access:
Attackers maintain continuous access to compromised systems, enabling further exploitation and lateral movement.
Stealthy data exfiltration:
Malicious scripts executed at login can quietly exfiltrate sensitive data, intellectual property, or credentials without user awareness.
Privilege escalation and lateral movement:
Persistent access enables attackers to escalate privileges, compromise additional hosts, and further infiltrate the network.
Disruption of critical services:
Malicious actions initiated at startup may disrupt or degrade critical system operations, causing downtime or operational interruptions.
Difficulty in remediation and incident response:
Undetected persistent footholds complicate remediation efforts, prolong incident response, and increase overall recovery costs.
Early detection and remediation of malicious XDG Autostart Entries significantly reduce the attacker's dwell time, minimize potential damage, and enhance overall security posture.
Examples
Real-world examples and attack scenarios involving XDG Autostart Entries include:
Operation Windigo (Ebury malware):
Attackers created persistent entries in XDG autostart directories to execute malicious payloads, enabling persistent SSH backdoors and credential theft.
Impact: Extensive compromise of Linux servers, persistent unauthorized access, credential harvesting.
HiddenWasp Linux malware:
HiddenWasp utilized XDG autostart entries to maintain persistent presence on infected Linux systems, executing malicious binaries at user login.
Impact: Persistent remote access, data exfiltration, and stealthy lateral movement across Linux environments.
APT Groups targeting Linux desktops:
Advanced Persistent Threat actors have repeatedly leveraged XDG autostart entries to maintain persistence after initial compromise through phishing or vulnerability exploitation.
Tools used: Custom scripts, reverse shells, keyloggers, and backdoor binaries executed automatically at login.
Impact: Long-term espionage, theft of sensitive information, intellectual property exfiltration, and persistent footholds within targeted organizations.
These examples illustrate the practical use of XDG Autostart Entries by attackers, emphasizing the importance of proactive detection, monitoring, and remediation strategies.
Last updated
Was this helpful?