Detect Lua in Elastic Security
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line via the standalone lua interpreter, via scripts (.lua), or from Lua-embedded programs. Adversaries may incorporate, abuse, or replace existing Lua interpreters to execute malicious code. Notable examples include EvilBunny (malware instrumented by Lua), Remsec/ProjectSauron (modular Lua-based APT), Line Runner (Cisco device implant using Lua), PoetRAT (Lua interpreter for Windows), and RedLine Stealer (Lua bytecode for evasion).
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.011 Lua
- Canonical reference
- https://attack.mitre.org/techniques/T1059/011/
Elastic Detection Query
sequence by host.id with maxspan=5m
[process where event.type == "start" and
(
process.name like~ ("lua", "lua.exe", "lua5*", "luajit", "luajit.exe", "luac", "luac.exe") or
process.args like~ ("*.lua", "*dofile(*", "*loadfile(*", "*loadstring(*", "*os.execute(*", "*io.popen(*", "*socket.tcp*", "*http.request*")
)
] by process.entity_id
[any where event.category in ("network", "file") and
(
(event.category == "network" and network.direction == "egress") or
(event.category == "file" and file.path like~ ("/tmp/*", "/var/tmp/*", "*\\Temp\\*", "*\\AppData\\*"))
)
] by process.parent.entity_id
// Alternatively, single-event detection:
// process where event.type == "start" and
// (
// process.name like~ ("lua", "lua.exe", "lua5*", "luajit", "luajit.exe", "luac", "luac.exe") or
// process.args like~ ("*.lua", "*os.execute(*", "*io.popen(*", "*loadstring(*", "*socket.tcp*", "*http.request*", "*socket.connect*", "*ltn12.pump*")
// ) and
// process.args like~ ("/tmp/*", "*\\Temp\\*", "*\\AppData\\*", "*os.execute(*", "*io.popen(*", "*loadstring(*", "*socket.*", "*http.request*")Detects execution of Lua interpreters (lua, luajit, luac) or Lua script patterns involving OS command execution, dynamic code loading, network socket use, or scripts running from temporary directories. Covers T1059.011 abuse patterns including EvilBunny, PoetRAT, Remsec, and Line Runner implant TTPs.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate embedded Lua use in game engines (e.g., World of Warcraft AddOns, Roblox tooling) or creative tools like Neovim, Hammerspoon, or Awesome WM which use Lua for configuration and plugins
- Network monitoring or automation tools such as Wireshark dissectors or NMAP NSE (Nmap Scripting Engine) which execute Lua scripts for legitimate packet analysis
- DevOps tooling pipelines where Lua is embedded in CI/CD frameworks, Redis scripting (EVAL with Lua), or OpenResty/Nginx Lua modules during build or test phases
Other platforms for T1059.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Lua OS Command Execution
Expected signal: Auditd: EXECVE record for lua with -e flag and os.execute in arguments. Child process event for whoami spawned by the Lua interpreter.
- Test 2Lua Network Socket Connection
Expected signal: Auditd: EXECVE record for lua with socket.tcp in arguments. Network connection attempt to 127.0.0.1:4444.
- Test 3Lua Dynamic Code Loading
Expected signal: Auditd: EXECVE record for lua with loadstring in arguments. The dynamically loaded code is executed at runtime.
References (6)
- https://attack.mitre.org/techniques/T1059/011/
- https://www.lua.org/start.html
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf
- https://blog.talosintelligence.com/poetrat-update/
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-new-variant-uses-lua-bytecode/
Unlock Pro Content
Get the full detection package for T1059.011 including response playbook, investigation guide, and atomic red team tests.