Detect Lua in Google Chronicle
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line via the standalone lua interpreter, via scripts (.lua), or from Lua-embedded programs. Adversaries may incorporate, abuse, or replace existing Lua interpreters to execute malicious code. Notable examples include EvilBunny (malware instrumented by Lua), Remsec/ProjectSauron (modular Lua-based APT), Line Runner (Cisco device implant using Lua), PoetRAT (Lua interpreter for Windows), and RedLine Stealer (Lua bytecode for evasion).
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.011 Lua
- Canonical reference
- https://attack.mitre.org/techniques/T1059/011/
YARA-L Detection Query
rule mitre_t1059_011_lua_execution {
meta:
author = "Argus Detection Engineering"
description = "Detects Lua interpreter execution or inline Lua API abuse indicative of T1059.011. Covers OS execution, network socket calls, dynamic script loading, and execution from temp paths."
severity = "MEDIUM"
priority = "MEDIUM"
mitre_attack_tactic = "Execution"
mitre_attack_technique = "T1059.011"
reference = "https://attack.mitre.org/techniques/T1059/011/"
created = "2026-04-16"
false_positives = "Game engines, Neovim plugins, OpenResty, Redis EVAL"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.target.process.command_line != ""
(
re.regex($e.target.process.file.full_path, `(?i)(lua|luajit|luac)(5[\d.]*)?(\.exe)?$`) or
re.regex($e.target.process.command_line, `(?i)(\.lua[\s"']|dofile\s*\(|loadfile\s*\(|loadstring\s*\(|require\s*\(|os\.execute\s*\(|io\.popen\s*\(|socket\.tcp|socket\.connect|http\.request|ltn12\.pump|io\.open\s*\()`) or
re.regex($e.target.process.file.full_path, `(?i)lua[0-9]*(jit|c)?\.exe`)
)
(
re.regex($e.target.process.command_line, `(?i)(os\.execute|io\.popen|socket\.tcp|socket\.connect|http\.request|loadstring|loadfile|dofile)`) or
re.regex($e.target.process.file.full_path, `(?i)(lua|luajit|luac)(\.exe)?$`)
)
$host = $e.principal.hostname
$user = $e.principal.user.userid
$cmdline = $e.target.process.command_line
$proc = $e.target.process.file.full_path
$parent = $e.principal.process.file.full_path
condition:
$e
}Chronicle YARA-L 2.0 rule detecting Lua interpreter launch events or embedded Lua API call patterns in process command lines. Identifies T1059.011 abuse via regex matching on UDM PROCESS_LAUNCH events for OS execution, network, and dynamic loading patterns.
Data Sources
Required Tables
False Positives & Tuning
- OpenResty or Nginx with Lua module (ngx_lua) deployments where LuaJIT executes as part of web request handling, generating frequent io.open and socket calls that match network patterns
- Hammerspoon (macOS automation tool) uses Lua extensively including os.execute and io.popen for system automation tasks like window management and hotkeys
- Scientific computing or data analysis environments using LuaJIT through Torch/PyTorch legacy installations, where loadstring and require are normal module loading patterns
Other platforms for T1059.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Lua OS Command Execution
Expected signal: Auditd: EXECVE record for lua with -e flag and os.execute in arguments. Child process event for whoami spawned by the Lua interpreter.
- Test 2Lua Network Socket Connection
Expected signal: Auditd: EXECVE record for lua with socket.tcp in arguments. Network connection attempt to 127.0.0.1:4444.
- Test 3Lua Dynamic Code Loading
Expected signal: Auditd: EXECVE record for lua with loadstring in arguments. The dynamically loaded code is executed at runtime.
References (6)
- https://attack.mitre.org/techniques/T1059/011/
- https://www.lua.org/start.html
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf
- https://blog.talosintelligence.com/poetrat-update/
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-new-variant-uses-lua-bytecode/
Unlock Pro Content
Get the full detection package for T1059.011 including response playbook, investigation guide, and atomic red team tests.