Detect Lua in Sumo Logic CSE
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line via the standalone lua interpreter, via scripts (.lua), or from Lua-embedded programs. Adversaries may incorporate, abuse, or replace existing Lua interpreters to execute malicious code. Notable examples include EvilBunny (malware instrumented by Lua), Remsec/ProjectSauron (modular Lua-based APT), Line Runner (Cisco device implant using Lua), PoetRAT (Lua interpreter for Windows), and RedLine Stealer (Lua bytecode for evasion).
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.011 Lua
- Canonical reference
- https://attack.mitre.org/techniques/T1059/011/
Sumo Detection Query
_sourceCategory=*windows*sysmon* OR _sourceCategory=*linux*auditd* OR _sourceCategory=*endpoint*
| where EventCode = 1 or type = "EXECVE" or EventID = 1
| parse field=CommandLine "*" as cmdline nodrop
| parse field=cmd "*" as cmdline nodrop
| where (
Image matches "*lua*.exe" or
Image matches "*luajit*" or
Image matches "*luac*" or
cmdline matches "*.lua*" or
cmdline matches "*dofile(*" or
cmdline matches "*loadfile(*" or
cmdline matches "*loadstring(*" or
cmdline matches "*os.execute(*" or
cmdline matches "*io.popen(*" or
cmdline matches "*socket.tcp*" or
cmdline matches "*socket.connect*" or
cmdline matches "*http.request*" or
cmdline matches "*ltn12.pump*" or
cmdline matches "*io.open(*" or
cmdline matches "*require(*"
)
| eval OsExec = if(cmdline matches "*os.execute*" or cmdline matches "*io.popen*", 2, 0)
| eval NetworkActivity = if(cmdline matches "*socket.tcp*" or cmdline matches "*socket.connect*" or cmdline matches "*http.request*", 2, 0)
| eval DynamicLoad = if(cmdline matches "*loadstring*" or cmdline matches "*loadfile*" or cmdline matches "*dofile*", 1, 0)
| eval SuspicionScore = OsExec + NetworkActivity + DynamicLoad
| where SuspicionScore > 0
| eval ScriptFromTemp = if(cmdline matches "*\\Temp\\*" or cmdline matches "*/tmp/*" or cmdline matches "*AppData*", "true", "false")
| fields _messageTime, _sourceHost, user, Image, cmdline, ParentImage, OsExec, NetworkActivity, DynamicLoad, SuspicionScore, ScriptFromTemp
| sort by SuspicionScore desc, _messageTime descSumo Logic search detecting Lua interpreter execution or embedded Lua API function calls that indicate T1059.011 abuse. Scores based on OS shell execution, network socket calls, and dynamic script loading. Correlates Windows Sysmon and Linux auditd sources.
Data Sources
Required Tables
False Positives & Tuning
- Game development pipelines using Lua for scripting (Love2D, Defold, Corona SDK) where developers test Lua scripts locally and use network sockets for live-reload or debugging protocols
- Neovim or other text editors configured with Lua plugins that call os.execute or io.popen for shell integration features like fuzzy finders, formatters, or LSP wrappers
- Automated test frameworks for embedded systems (Lunit, busted) running Lua test suites in CI/CD environments that exercise file I/O and process execution APIs
Other platforms for T1059.011
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Lua OS Command Execution
Expected signal: Auditd: EXECVE record for lua with -e flag and os.execute in arguments. Child process event for whoami spawned by the Lua interpreter.
- Test 2Lua Network Socket Connection
Expected signal: Auditd: EXECVE record for lua with socket.tcp in arguments. Network connection attempt to 127.0.0.1:4444.
- Test 3Lua Dynamic Code Loading
Expected signal: Auditd: EXECVE record for lua with loadstring in arguments. The dynamically loaded code is executed at runtime.
References (6)
- https://attack.mitre.org/techniques/T1059/011/
- https://www.lua.org/start.html
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf
- https://blog.talosintelligence.com/poetrat-update/
- https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/
- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-new-variant-uses-lua-bytecode/
Unlock Pro Content
Get the full detection package for T1059.011 including response playbook, investigation guide, and atomic red team tests.