T1059.011 · execution · 0 actors · 0 correlated reports

Lua

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State). Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.

Open detection, hunting, mitigation, and evidence workspace

Detection logic

Use behavior-focused telemetry and validate findings against surrounding activity.

Observed actors

Correlated CTI and IR reports

Continue the investigation