Command and Scripting Interpreter: Lua
- ID
- T1059.011
- Tactics
- TA0002 Execution
- Sub-technique of
- T1059 Command and Scripting Interpreter
- Platforms
- Linux, Network Devices, Windows, macOS
- Data sources
- Process Creation, File Creation, File Metadata, Command Execution, Script Execution
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).[1][2]
Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.[3][4][5][6]
Detection
- DET0101 Detection Strategy for Lua Scripting Abuse
Data components: Process Creation, File Creation, File Metadata, Command Execution, Script Execution
Mitigations (3)
- M1033 Limit Software Installation
Prevent users from installing Lua where not required.
- M1038 Execution Prevention
Denylist Lua interpreters where appropriate.
- M1047 Audit
Inventory systems for unauthorized Lua installations.