Implant Enumeration of Installed Applications via .desktop Files Correlated with Persistence Activity

Duo Tech@duotech

•updated Aug 21, 2026•0•0•5

Detects enumeration of installed applications via .desktop files by a process outside known desktop-environment binaries, correlated with a subsequent persistence-related file write, matching the botking implant's discovery-then-persist behavior.