MITRE ATT&CK Technique
T1547.013XDG Autostart Entries
- First Reported
- May 4, 2026
- Latest Reported
- May 25, 2026
Official Description
Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys)
Adversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file. When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed. System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory.
Adversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022)
Adversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file. When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed. System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory.
Adversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022)
- Tactics
- Persistence, Privilege Escalation
- Platforms
- Linux
- Parent Technique
- T1547 · Boot or Logon Autostart Execution
- MITRE Version
- 1.2
- Last Modified
- Oct 24, 2025
Reported Context (2)
- The article reports QLNX dropping quasar_linux.desktop in ~/.config/autostart/. QLNX Linux RAT Targets Developer Workstations with Fileless Execution and Credential Theft
- QLNX can persist through XDG desktop autostart files. Researchers Detail QLNX Linux RAT With Rootkit, PAM Backdoor and Developer Credential Theft
Malware (1)
People (3)
MITRE ATT&CK (36)
Vendors (2)
Products (3)
Tools (7)
Industries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.