T1059.011 — Lua

Tactic: Execution · Platforms: Linux, Network Devices, Windows, macOS

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (4)

T1059.011 Command and Scripting Interpreter: Lua

title: "T1059.011 Command and Scripting Interpreter: Lua"
id: 768a3891-9b8d-48fc-a555-8eb3d1ff3ee8
description: 'Detection Strategy for Lua Scripting Abuse. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: ParentProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1059/011
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.execution
  - attack.t1059.011

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\Lua.exe'

  condition: selection

falsepositives:
  - Rare in typical enterprise Windows environments outside specific software (games, some automation frameworks) that embed Lua.

level: low

T1059.011 Command and Scripting Interpreter: Lua

title: "T1059.011 Command and Scripting Interpreter: Lua"
id: 9eb18f44-5bb0-4fac-895a-0868bf79c482
description: 'Detection Strategy for Lua Scripting Abuse. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutablePath, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1059/011
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.execution
  - attack.t1059.011

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_execve:
    type: EXECVE
    a0|endswith:
      - '/lua'
      - '/lua5.1'
      - '/lua5.3'
      - '/luajit'
  selection_syscall:
    type: SYSCALL
    exe|endswith:
      - '/lua'
      - '/lua5.1'
      - '/lua5.3'
      - '/luajit'

  condition: 1 of selection_*

falsepositives:
  - Lua interpreters are legitimately invoked by Nginx/OpenResty modules, game engines, and window managers (awesome-wm), so this needs host-scoping to systems where Lua is not normally installed.

level: medium

T1059.011 Command and Scripting Interpreter: Lua

title: "T1059.011 Command and Scripting Interpreter: Lua"
id: 014bf0a9-97ac-4f55-8514-611d8122016b
description: 'Detection Strategy for Lua Scripting Abuse. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessName, SignatureStatus.'
references:
  - https://attack.mitre.org/techniques/T1059/011
author: Shahrukh Khan
date: 2026-03-12
license: MIT
tags:
  - attack.execution
  - attack.t1059.011

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/lua'
      - '/lua5.3'
      - '/lua5.4'
  selection_parent:
    ParentImage|endswith:
      - '/osascript'
      - '/curl'
  condition: selection and selection_parent

falsepositives:
  - Legitimate applications embedding Lua scripting engines for configuration or plugin systems, since Lua execution is uncommon on macOS and signature status of the parent process is not always resolvable from unified log fields.

level: medium

T1059.011 Command and Scripting Interpreter: Lua

title: "T1059.011 Command and Scripting Interpreter: Lua"
id: 41115227-e874-4ad1-969f-fd2667a01531
description: 'Detection Strategy for Lua Scripting Abuse. (Data Component: Script Execution; baseline tier: fallback.) Tune using: FirmwareBuildHash, ScriptInjectionPath.'
references:
  - https://attack.mitre.org/techniques/T1059/011
author: Shahrukh Khan
date: 2026-04-01
license: MIT
tags:
  - attack.execution
  - attack.t1059.011

logsource:
  product: networkdevice
  service: runtime

detection:
  selection_eem:
    CommandLine|contains:
      - 'event manager applet'
      - 'tclsh'
      - 'event manager environment'
  condition: selection_eem

falsepositives:
  - Legitimate use of embedded event manager scripts by network engineers for automation and monitoring tasks will also match.

level: medium

Related sub-techniques

Explore