T1059.011sub-technique of T1059 Command and Scripting Interpreter
Lua
Linux · Network Devices · Windows · macOSnothing on this site yetT1059.011 on attack.mitre.org
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (`.lua`), or from Lua-embedded programs (through the `struct lua_State`). Lua scripts may be executed by adversaries for malicious purposes.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection Strategy for Lua Scripting Abuse
- Detects execution of Lua interpreters or scripts (.lua), especially when correlated with suspicious parent processes or file drop events, indicating malicious use of embedded scripting.
- Detects invocation of lua or luajit interpreters by users or services outside of expected packages, chained with script drop or memory artifacts.
- Detects Lua script execution via native or 3rd party interpreters, chained with unsigned binaries or unexpected parent lineage.
- Detects embedded Lua interpreter execution or script injection on devices supporting Lua scripting (e.g., routers, firewalls), often seen in modified firmware or abused APIs.