Activity timeline
T1547.013 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 10 of the 10 threats were reported in the twelve months to 2026-07.
How adversaries use it
T1547.013 XDG Autostart Entries is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix, as a sub-technique of T1547 Boot or Logon Autostart Execution. Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 2 critical, 7 high, 1 medium.
Threats that use T1547.013 most often also use T1005 Data from Local System (9 threats), T1552.001 Credentials In Files (9 threats), T1027 Obfuscated Files or Information (8 threats), T1041 Exfiltration Over C2 Channel (8 threats), T1071.001 Web Protocols (8 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
5 tracked threat actors appear in the threats that use T1547.013; the most frequent are APT34 (1), Cavern Manticore (1), Contagious Interview cluster (1), TeamPCP (1), WageMole (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1547.013.
Data sources
Telemetry that can reveal T1547.013, per MITRE ATT&CK.
- Command — Command Execution
- File — File Creation, File Modification
- Process — Process Creation
Threat actors using it
Tracked threats
10 tracked threats use T1547.013.
- Project CAV3RN / Cavern Manticore: Iran-Linked Modular Cyberespionage Framework Abuses Outlook Calendar…high
- SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and…high
- macOS Infostealer Hijacks Telegram Desktop Sessions via tdata Theft to Bypass 2FA, Harvests Keychain…high
- ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE, Data Theft, and Supply-Chain Backdoors…high
- EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver…high
- npm 12 Disables Install Scripts, Git Dependencies, and Remote Tarball URLs by Default to Curb Supply-Chain…medium
- PolinRider Campaign: North Korea-Linked Supply Chain Attack Expands Across npm, Packagist, Go Modules, and…high
- Quasar Linux (QLNX) — Sophisticated Linux RAT With LD_PRELOAD Rootkit, PAM Backdoor & DevOps Credential…high
- TeamPCP LiteLLM Supply Chain Attack — Trojaned PyPI Packages (v1.82.7/1.82.8) with Multi-Stage C2 Payloadcritical
- EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious Interviewcritical
Detection coverage
Threadlinqs maintains 12 detection rules mapped to T1547.013 (SPL 4, KQL 5, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1547 Boot or Logon Autostart Execution — 349 tracked threats at the technique level.