Google Unveils New Threat Hunting Method to Detect Malicious .desktop Files

Google Threat Intelligence has announced a new set of technical threat hunting methodologies aimed at proactively identifying malicious .desktop files-an emerging attack vector targeting Linux environments.

The approach leverages recent discoveries related to a campaign first outlined by Zscaler researchers in 2023, where threat actors abused legitimate .desktop files to execute obfuscated payloads and facilitate malware delivery, often by abusing trusted platforms like Google Drive.

Malicious .desktop File Campaigns Resurge

.desktop files are plaintext configuration files that conform to the FreeDesktop Desktop Entry Specification.

Used across Linux systems, they dictate how applications are launched and displayed within desktop menus and search results.

While their structure typically begins with [Desktop Entry] and includes predictable keys such as Name, Comment, Exec, and Icon, recent attacks have introduced significant obfuscation.

Malicious variants have been observed with thousands of lines of junk code (such as repeated # symbols) preceding the legitimate desktop entry formatting.

This obfuscation, visible in both string and hexadecimal file views, is designed to evade signature-based detection and analyst review.

Upon execution, these files routinely exploit system utilities like xdg-open to launch their payloads, often opening a Google Drive-hosted PDF as a decoy for the user.

While the PDF serves as a distraction, subsequent malware components are silently downloaded and executed.

The execution chain for these files in XFCE environments involves xdg-open invoking exo-open, which in turn calls exo-helper-2 to determine the appropriate MIME type handler-typically resulting in the system’s default browser (such as Firefox) launching the malicious URL.

The equivalent processes in GNOME and KDE environments are gio open and kde-open, respectively.

Detection Strategies Empower Security Teams

According to the Report, Google’s new threat hunting strategies focus on behavioral analytics derived from process telemetry. Security teams are encouraged to monitor for process arguments such as --launch WebBrowser in combination with Google Drive or other suspicious URLs.

For example, queries like behavior_processes:"--launch WebBrowser" and behavior_processes:"https://drive.google.com/" have proven effective in identifying not only malicious .desktop files but also ELF binaries with comparable behavior.

More comprehensive detection rules expand the search scope to encompass all related process activity-across XFCE, GNOME, and KDE-by including patterns involving xdg-open, exo-open, exo-helper-2, gio open, and kde-open.

These can be further refined with conditions that target the download and execution behaviors seen in recent attacks, such as the presence of .pdf files or suspicious shell script activity originating from these desktop entry files.

Additionally, forensic analysis of command line executions linked to xdg-open has revealed telltale invocations of commands like /usr/bin/grep -i ^xfce_desktop_window and /usr/bin/xprop xprop -root.

These are utilized during environment detection within the malicious chain and have been successfully leveraged as high-fidelity threat hunting indicators when filtered alongside .desktop file attributes or network traffic to Google Drive.

Detection efforts are also bolstered by string analysis of both ASCII and hexadecimal representations of file content.

Searching for embedded patterns such as Exec=bash -c ", Name=, .pdf, and [Desktop Entry] can offer quick wins in automated scanning platforms.

Recent case studies illustrate the continued evolution and prevalence of this technique.

In one instance, a .desktop file initiated the download and execution of multiple shell scripts, culminating in the deployment of a cryptocurrency miner, as confirmed by subsequent analysis of dropped configuration files linking to known malicious infrastructure.

Security teams are encouraged to adapt these detection queries for their own environments, translating them to fit the specifics of their endpoint detection and response platforms or SIEMs. Google Threat Intelligence will continue to monitor for new behaviors as adversaries further adapt their techniques.

IOCs from Recent Malicious .desktop File Campaigns

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates