Line Runner

Line Runner is a persistent backdoor and web shell allowing threat actors to upload and execute arbitrary Lua scripts. Line Runner is associated with the ArcaneDoor campaign.

View graph Watch Export

Indicators tracked

Intelligence Reports20

20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

15 relationships

T1557: Adversary-in-the-Middle

source

T1505.003: Web Shell

source

T1041: Exfiltration Over C2 Channel

source

T1059.011: Lua

source

T1070.004: File Deletion

source

T1071.001: Web Protocols

source

T1653: Power Settings

source

T1027.015: Compression

source