Netskope Threat Labs

ShellRunner

ATP Sandbox Adv. HeuristicsAV

ShellRunner is a detection name for shell execution tools.

First seen
August 2023
Last seen
October 2026
Alert Name
DeepScan:Generic.XML.ShellRunner.A.FFFFFFFE
Document-XML.Backdoor.ShellRunner
Document-XML.Exploit.ShellRunner
Document-XML.Malware.ShellRunner
Document-XML.Trojan.ShellRunner
Dropped:Generic.XML.ShellRunner.A.FB95A127
Dump:Generic.XML.ShellRunner.A.FFFFFFFE
Dump:Generic.XML.ShellRunner.B.FFFFFFFE
Dump:Generic.XML.ShellRunner.B.FFFFFFFE:144A2
Dump:Generic.XML.ShellRunner.B.FFFFFFFE:1B1E7