This rule detects the creation of Linux XDG autostart desktop entries (.desktop files) placed in standard autostart locations, which can cause automatic execution during user login. It covers both system-wide (/etc/xdg/autostart) and user-local (~/.config/autostart) paths. Adversaries abuse these entries to achieve persistence in Linux desktop environments, either without root privileges (user-local) or system-wide when written to /etc/xdg/autostart. The analytic relies on Sysmon for Linux EventID 11 data, surfaced through the Endpoint filesystem data model, and flags events where a .desktop file is created within the autostart directories. The detection uses a Splunk tstats query over Endpoint.Filesystem to identify creation events with file_path matching the autostart locations and a .desktop file_name, collecting related metadata (create/modify times, hash, user, processing context). The result is enriched with process and file context and presented as a potential Linux persistence indicator. MITRE mappings include T1547 (Boot or Logon Autostart), T1037 (Startup Items), and T1059.004 (Unix Shell). The rule is intended for Splunk Enterprise/Security deployments using a CIM-normalized data model (Endpoint > Filesystem) fed by EDR telemetry that provides file creation events. The analytic story highlights Linux persistence techniques and post-exploitation activity, with drilldown options to view per-user and per-destination results and to correlate with risk events. The detection is designed to surface suspicious autostart activity for investigation and containment."