Line Runner
- ID
- S1188
- Type
- Malware
- Platforms
- Network Devices
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Line Runner is a persistent backdoor and web shell allowing threat actors to upload and execute arbitrary Lua scripts. Line Runner is associated with the ArcaneDoor campaign.[1][2]
Techniques used (8)
- T1027.015 Compression
- T1041 Exfiltration Over C2 Channel
- T1059.011 Lua
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1505.003 Web Shell
- T1557 Adversary-in-the-Middle
- T1653 Power Settings