T1059.011: Lua

MITRE ATT&CK® Enterprise technique

Description

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state)

Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)

Detection

(no detection guidance published)

Data sources

• (none listed)

References

• ATT&CK page: https://attack.mitre.org/techniques/T1059/011
• ATT&CK Enterprise matrix: https://attack.mitre.org/matrices/enterprise/