Line Dancer
- ID
- S1186
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Line Dancer is a memory-only Lua-based shellcode loader associated with the ArcaneDoor campaign. Line Dancer allows an adversary to upload and execute arbitrary shellcode on victim devices.[1][2]
Techniques used (9)
- T1014 Rootkit
- T1040 Network Sniffing
- T1041 Exfiltration Over C2 Channel
- T1059.008 Network Device CLI
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1653 Power Settings
- T1690 Prevent Command History Logging