Rapid7’s 2026 Global Cybersecurity Summit is now available on-demand.Watch sessions.
Rapid7

module

Autostart Desktop Item Persistence

Disclosed
Feb 13, 2006

Description

This module will create an autostart .desktop entry to execute a payload.
The payload will be executed when the users logs in.
Verified on Ubuntu 22.04 desktop with Gnome, and 18.04.3.
The following payloads were used in testing:
- cmd/unix/reverse_netcat
- linux/x64/meterpreter/reverse_tcp
- cmd/linux/http/x64/meterpreter/reverse_tcp
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.