Detect Line Runner by monitoring for unusual command-line execution, encoded script use, and connections that follow archive, document, or installer launch. Hunt for persistence changes, suspicious file drops, and process chains that start from user-facing applications and end in scripting or network tools. Confirm with endpoint and network telemetry, then check whether the activity matches approved administration.
What Line Runner detection should look for in telemetry
Line Runner is best detected by building a pattern, not a signature. The strongest signals are unusual command-line execution, encoded or obfuscated script use, and parent-child process chains that begin in user-facing applications and end in scripting hosts or network-enabled tools. That pattern becomes much more convincing when it follows the opening of an archive, document, or installer.
Hunt for execution paths that break normal user workflow: a browser, office app, PDF reader, or archive utility spawning PowerShell, cmd, mshta, wscript, rundll32, or a downloader. The practical question is whether the process tree reflects a legitimate administrative task or an interactive lure that triggered a staged payload.
Because the direct answer already points to endpoint and network telemetry, the detection strategy should join process visibility with outbound connections and file activity. For this kind of activity, the value comes from correlation, not isolated alerts. One suspicious command line is useful; a suspicious command line plus a new persistence entry and an unusual outbound session is much stronger.
How to separate attack activity from approved administration
The most reliable way to reduce false positives is to compare the event chain with approved admin patterns. Legitimate automation usually has a stable parent process, a known host, predictable command syntax, and a documented maintenance window. Malicious activity often looks noisier, uses user context instead of service context, and appears after a file open or download event rather than from a managed deployment path.
Endpoint triage should ask whether the commands were launched by a trusted management tool, a signed script, or a known service account, and whether the target host normally performs that role. If the answer is no, treat the activity as potentially adversarial even when the individual command on its own is common in IT operations.
Network telemetry matters because many staged infections reveal themselves by the timing and destination of the first outbound connection. A host that opens a document and then immediately reaches out to an unfamiliar domain, IP, or external service deserves closer inspection than a host making routine connections from a management subnet.
What to inspect after the initial alert
Once the pattern is identified, the next step is to test for persistence, file drops, and signs of follow-on execution. That means checking startup locations, scheduled tasks, services, autoruns, registry run keys, new binaries in temporary or user-writable paths, and any recently modified scripts or shortcut files. Those artifacts help distinguish a one-off suspicious command from an established foothold.
Also review whether the activity introduced additional tooling for collection or lateral movement. A small loader chain may be followed by credential theft, remote access, or repeat execution under different names. If multiple hosts show the same process pattern, treat it as a campaign indicator rather than a single-user anomaly.
For teams already using the Malware Guide, this is the kind of process-and-behaviour pattern that fits broader malware detection work: identify the loader chain, then trace what it launched, dropped, or contacted.
Risk and Threat Considerations
Line Runner-style activity is risky because it often blends into common user actions while quietly moving execution into script hosts, downloaders, or persistence mechanisms. That makes it attractive for initial access, staged payload delivery, and low-noise execution that can survive basic allowlisting and casual review.
Failure mechanism: The intrusion succeeds when a user-facing application launches a second-stage process chain that is not normally expected in that context, allowing the attacker to execute code, drop files, and establish persistence before defenders correlate the sequence.
Impact: If teams miss the chain, they may only see isolated “normal” commands and lose the opportunity to stop credential theft, further payloads, or repeat access on the affected host.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | Line Runner detection centers on suspicious script and command execution chains. |
| T1204 — User Execution | The activity often begins after a user opens an archive, document, or installer. | |
| T1547 — Boot or Logon Autostart Execution | Persistence checks are part of confirming whether the activity established a foothold. | |
| Recommendation — Map suspicious process chains to T1059 and alert on unexpected script host execution. Correlate lure-driven file opens with downstream execution to flag T1204 activity. Hunt for autoruns, scheduled tasks, and logon persistence under T1547. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Unauthorized Personnel, Connections, Devices, and Software | The question is about detecting suspicious execution and connections in telemetry. |
| DE.AE-02 — Anomalous Activity Is Detected | Detection of unusual command lines and process chains is the core objective. | |
| Recommendation — Monitor endpoint and network telemetry for anomalous processes and connections. Tune detections to surface anomalous execution patterns quickly. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Process, file, and network correlation depends on retained endpoint and network logs. |
| Recommendation — Centralize and retain logs needed to reconstruct process and network chains. | ||
Practitioner Guidance
What to verify: Confirm the full chain, parent process, child process, file origin, and network destination before deciding the event is benign. A single suspicious command is not enough; the surrounding launch context usually determines whether it is malicious or administrative.
Decision rule: If the activity starts from an archive, document, installer, or browser and ends in a scripting host or network tool, treat it as hostile until the business owner can prove a legitimate workflow. If it originates from a managed admin path, validate the approved toolchain and scope instead of escalating immediately.
What practitioners underestimate: Persistence and file-drop checks are often where the real answer appears. The first alert may be noisy, but the second and third artefacts, especially scheduled tasks, autoruns, and newly written scripts, usually reveal whether the host was merely probed or fully compromised.
Practitioner takeaway: The best detection is a sequence view, not a single alert, because Line Runner is most visible when endpoint, file, and network telemetry are correlated into one execution story.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org