Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
3
Categories
2
1
1
Platforms
3
1
Products / Services
1
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
1
IDS Protocols
1
Detects creation of XDG autostart entries for Linux desktop persistence
Detects creation of XDG autostart entries for Linux desktop persistence
This rule detects the creation of an XDG Autostart entry on a Linux host by looking for network traffic containing the string "/etc/xdg/autostart/" in a TCP flow to the server on port 22. This directory is commonly used for persistence by malware to automatically execute at system startup.