Lua abuse (MITRE ATT&CK T1059.011) is an Execution technique. MITRE lists Linux, macOS, Windows and network devices as platforms.
Lua is a cross-platform scripting language designed mainly for embedding in applications. It can run from the command line through the standalone lua interpreter, from .lua script files, or from Lua-embedded programs through the lua_State struct.
How attackers use it
MITRE says adversaries may run Lua scripts for malicious purposes. They may also incorporate, abuse or replace existing Lua interpreters so that malicious Lua commands execute at runtime. Because many programs embed Lua, the interpreter may already be present in software you installed for other reasons.
How to detect it
MITRE's detection strategy has analytics per platform:
- Windows: Lua interpreters or .lua scripts, especially with suspicious parent processes or file drop events.
- Linux: lua or luajit invoked by users or services outside expected packages, chained with script drops or memory artifacts.
- macOS: Lua scripts through native or third-party interpreters, chained with unsigned binaries or unexpected parent lineage.
- Network devices: embedded Lua interpreter execution or script injection on routers and firewalls, often seen with modified firmware or abused APIs.
Process creation with parent and command line, plus file creation events, are the core data.
How to reduce the risk
MITRE lists three mitigations:
- Limit software installation. Prevent users from installing Lua where it is not required.
- Audit. Inventory systems for unauthorized Lua installations.
- Execution prevention. Denylist Lua interpreters where appropriate.
Quick check
Why audit for Lua when you never installed it?
Lua is designed for embedding, so applications can ship their own interpreter. An inventory shows which hosts have one and whether it is expected.
