Command and Scripting Interpreter: Lua T1059.011
Tactic: Execution
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).
Events covered
1 catalog event is tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| ESF | exec | Process Execution |
Authoring guide
These 14 rules share fields, values, and exclusions.
Fields filtered most (25 distinct)
These fields appear most often in rule filters.
| Field | Rules | How | Sample values |
|---|---|---|---|
event.type | 12 | eq 12 | start |
EventType | 11 | eq 7, in 4 | exec, ProcessRollup2, exec_event, executed, connected-to |
process_name | 10 | starts_with 8, in 6, eq 5, wildcard 4, ends_with 1 | bash, awk, base16, base32, base64 |
process.args | 9 | eq 8, contains 5, wildcard 4, starts_with 3, in 2 | -c, */bin/*sh*, *import*pty*spawn*, *import*subprocess*call*, -e |
CommandLine | 6 | contains 5, wildcard 5, length_compare 2, regex_match 1 | --decode, -d, -e , *-*d*, *].pack("H*")* |
host.os.type | 5 | eq 5 | |
ParentImage | 3 | is_not_null 1, starts_with 1, wildcard 1 | /bin/lua*, /bin/node, /bin/perl*, /etc/update-motd.d/ |
Image | 2 | starts_with 2 | /bin/lua, /bin/perl, /bin/php, /usr/bin/lua, /usr/local/bin/lua |
container.id | 2 | starts_with 2 | ? |
parent_process_name | 2 | eq 1, in 1 | bun, bun.exe, node, socat |
process.args_count | 2 | eq 1, ge 1, le 1 | 1, 2, 3 |
CurrentDirectory | 1 | contains 1 | .next, .pnpm/next, bin/next |
Esql.any_payload_keyword_max | 1 | eq 1 | 1 |
Esql.event_count | 1 | lt 1 | 5 |
Initiated | 1 | eq 1 | egress |
Top indicator values (503 distinct)
These values appear most often in rule predicates.
Exclusions (219 distinct)
These values appear most often in top-level exclusions.
| Field | Kind | Value | Rules excluding |
|---|---|---|---|
CurrentDirectory | wildcard | 2 | |
CurrentDirectory | wildcard |
| 2 |
CurrentDirectory | wildcard |
| 2 |
CurrentDirectory | wildcard |
| 2 |
CurrentDirectory | wildcard |
| 2 |
CurrentDirectory | wildcard |
| 2 |
ParentCommandLine | wildcard |
| 2 |
ParentImage | wildcard | 2 | |
dest_ip | cidr_match |
| 2 |
dest_ip | cidr_match |
| 2 |
dest_ip | cidr_match |
| 2 |
dest_ip | cidr_match | 2 | |
process_name | starts_with | 2 | |
CommandLine | contains |
| 1 |
CommandLine | contains |
| 1 |
Rules under this technique
These vendors publish rules tagged with this technique.
Platform (all)
Domain (all)
Elastic 14 rules
- Base64 Decoded Payload Piped to Interpreter
- Command Interpreter with IP Address Argument
- Decoded Payload Piped to Interpreter Detected via Defend for Containers
- Long Base64 Command Execution via Interactive Shell
- Long Base64 Encoded Interpreter Command Line
- Potential Fileless Execution via Memory File Descriptor from Interpreter
- Potential Hex Payload Execution via Common Utility
- Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)
- Potential Reverse Shell via UDP
- Process Spawned from Message-of-the-Day (MOTD)
- Suspicious Interpreter Execution Detected via Defend for Containers
- Suspicious Lua Command Execution
- Suspicious React Server Child Process
- Web Server Potential Command Injection Request