tfMITRE ATT&CK sub-technique

Lua T1059.011

sub-technique of T1059 Command and Scripting Interpreter

Tactic: Execution
Platforms: Linux, Network Devices, Windows, macOS
Version: 1.1
Created: 05 August 2024
Last modified: 15 April 2025

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Lua MITRE reference T1059.011

66th pctamong all ATT&CK techniques for number of tools

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

RedLine StealerS1240 ↗

Malware has leveraged Lua bytecode to perform malicious behavior.1

created 2025-09-17MALWARE

Line RunnerS1188 ↗

Utilizes Lua scripts for command execution.1 2

created 2025-01-06MALWARE

PoetRATS0428 ↗

Has executed a Lua script through a Lua interpreter for Windows.1

created 2020-04-27MALWARE

EvilBunnyS0396 ↗

Has used Lua scripts to execute payloads.1

created 2019-06-28MALWARE

RemsecS0125 ↗

Can use modules written in Lua for execution.1

created 2017-05-31MALWAREcarried by 1 group

All 5 software entries for this technique

Offense vs defense T1059.011

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Lua detection strategy DET0101

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Lua Scripting Abuse

Enterprise

4 platforms

AN0278 · Windows

Detects execution of Lua interpreters or scripts (.lua), especially when correlated with suspicious parent processes or file drop events, indicating malicious use of embedded scripting.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	May vary depending on delivery vector (e.g., explorer.exe, cmd.exe, rundll32.exe)
TimeWindow	Used to correlate file drop and execution of Lua scripts in close succession.

AN0279 · Linux

Detects invocation of lua or luajit interpreters by users or services outside of expected packages, chained with script drop or memory artifacts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File MetadataDC0059	auditd:SYSCALL	PATH

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutablePath	Lua interpreter path may vary based on distro or adversary staging.
UserContext	May need to exclude service or admin accounts that use Lua legitimately.

AN0280 · macOS

Detects Lua script execution via native or 3rd party interpreters, chained with unsigned binaries or unexpected parent lineage.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	macos:unifiedlog	log stream

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Adjustable based on system activity patterns (e.g., Terminal vs GUI)
SignatureStatus	Helps filter unsigned or self-signed Lua payloads.

AN0281 · Network Devices

Detects embedded Lua interpreter execution or script injection on devices supporting Lua scripting (e.g., routers, firewalls), often seen in modified firmware or abused APIs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	networkdevice:runtime	runtime

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FirmwareBuildHash	Used to baseline known good versions versus injected scripts.
ScriptInjectionPath	Path to where scripts are allowed or denied based on config.

Lua detections T1059.011

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs