AN0278
Analytic 0278
Windows
Detects execution of Lua interpreters or scripts (.lua), especially when correlated with suspicious parent processes or file drop events, indicating malicious use of embedded scripting.
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[ParentProcessName]
May vary depending on delivery vector (e.g., explorer.exe, cmd.exe, rundll32.exe)
[TimeWindow]
Used to correlate file drop and execution of Lua scripts in close succession.
AN0279
Analytic 0279
Linux
Detects invocation of lua or luajit interpreters by users or services outside of expected packages, chained with script drop or memory artifacts.
auditd:SYSCALL
execve
auditd:SYSCALL
PATH
[ExecutablePath]
Lua interpreter path may vary based on distro or adversary staging.
[UserContext]
May need to exclude service or admin accounts that use Lua legitimately.
AN0280
Analytic 0280
macOS
Detects Lua script execution via native or 3rd party interpreters, chained with unsigned binaries or unexpected parent lineage.
macos:unifiedlog
log stream
[ParentProcessName]
Adjustable based on system activity patterns (e.g., Terminal vs GUI)
[SignatureStatus]
Helps filter unsigned or self-signed Lua payloads.
AN0281
Analytic 0281
Network Devices
Detects embedded Lua interpreter execution or script injection on devices supporting Lua scripting (e.g., routers, firewalls), often seen in modified firmware or abused APIs.
networkdevice:runtime
runtime
[FirmwareBuildHash]
Used to baseline known good versions versus injected scripts.
[ScriptInjectionPath]
Path to where scripts are allowed or denied based on config.