Lua interpreter executed or a .lua script passed to a binary

Siemphony@siemphonyinformationalT1059.011unverifiedPlaybook · Unexpected execution

Two observables for AN0278's "execution of Lua interpreters or scripts (.lua)" on a single process-creation event. The first is a named Lua interpreter as the process image. The second exists because Lua interpreters ship under many names and version suffixes (lua5.1.exe, luajit.exe, or a renamed build) and an image-name list alone is defeated by any name not on it — but a .lua path on a command line only proves that a process referenced the file, not that it executed it, so that branch excludes images under Program Files and System32 and a short list of named editors, version-control and search tools that read .lua files as content. That list is necessarily incomplete — antivirus and EDR content scanners are closed-source and vary by vendor, so no Image allowlist can exclude them, and any other editor, backup tool or file-copy utility not named in the filter survives and matches on nothing more than a .lua path in argv. This branch therefore does not detect Lua execution; it detects "some process was invoked with a .lua path as an argument," and the level below is set for that population, not for the narrower interpreter-usage noise the filter does catch. AN0278's file-drop correlation (Sysmon EventID 11) and its TimeWindow knob describe a join across two event types Sigma cannot express, so only the process-creation event is authored, and a renamed interpreter staged inside Program Files, or Lua embedded through struct lua_State with no separate process at all, produces no match here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0101, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Lua interpreter executed or a .lua script passed to a binary2id: a9af0bd9-f1e0-4e70-94d2-f116301d56373status: experimental4description: |5  Two observables for AN0278's "execution of Lua interpreters or scripts6  (.lua)" on a single process-creation event. The first is a named Lua7  interpreter as the process image. The second exists because Lua interpreters8  ship under many names and version suffixes (lua5.1.exe, luajit.exe, or a9  renamed build) and an image-name list alone is defeated by any name not on10  it — but a .lua path on a command line only proves that a process referenced11  the file, not that it executed it, so that branch excludes images under12  Program Files and System32 and a short list of named editors, version-control13  and search tools that read .lua files as content. That list is necessarily14  incomplete — antivirus and EDR content scanners are closed-source and vary by15  vendor, so no Image allowlist can exclude them, and any other editor, backup16  tool or file-copy utility not named in the filter survives and matches on17  nothing more than a .lua path in argv. This branch therefore does not detect18  Lua execution; it detects "some process was invoked with a .lua path as an19  argument," and the level below is set for that population, not for the20  narrower interpreter-usage noise the filter does catch.21  AN0278's file-drop correlation (Sysmon EventID 11) and its TimeWindow knob22  describe a join across two event types Sigma cannot express, so only the23  process-creation event is authored, and a renamed interpreter staged inside24  Program Files, or Lua embedded through struct lua_State with no separate25  process at all, produces no match here.26  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0101, not hand-written and not tested by its author. Any lab result is on this rule's own page.27references:28  - https://attack.mitre.org/techniques/T1059/01129  - https://attack.mitre.org/detectionstrategies/DET010130author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)31date: 2026-08-1632tags:33  - attack.execution34  - attack.t1059.01135logsource:36  category: process_creation37  product: windows38detection:39  selection_interpreter:40    Image|endswith:41      - '\lua.exe'42      - '\lua5.1.exe'43      - '\lua5.2.exe'44      - '\lua5.3.exe'45      - '\lua5.4.exe'46      - '\lua51.exe'47      - '\lua52.exe'48      - '\lua53.exe'49      - '\lua54.exe'50      - '\luajit.exe'51      - '\wlua.exe'52  selection_script_arg:53    CommandLine|endswith:54      - '.lua'55      - '.lua"'56  filter_installed_path:57    Image|contains:58      - '\program files\'59      - '\program files (x86)\'60      - '\windows\system32\'61      - '\windows\syswow64\'62  filter_content_tools:63    Image|endswith:64      - '\code.exe'65      - '\nvim.exe'66      - '\vim.exe'67      - '\sublime_text.exe'68      - '\notepad++.exe'69      - '\git.exe'70      - '\rg.exe'71      - '\findstr.exe'72      - '\7z.exe'73      - '\tar.exe'74      - '\robocopy.exe'75      - '\xcopy.exe'76  condition: selection_interpreter or (selection_script_arg and not (filter_installed_path or filter_content_tools))77falsepositives:78  - "Any non-interpreter process invoked with a .lua path as its last command-line argument that is not one of the named editors or content tools in the filter — antivirus and EDR content scanners walking the filesystem, other text editors and IDEs, backup and file-sync utilities such as rsync-for-Windows or rclone, and archivers not named in the filter. This is the dominant, undisclosed noise source for the untethered branch: it never executed as Lua, it only named a .lua path."79  - "Editors, package managers and Lua language servers installed under a user profile rather than Program Files — Neovim or lua-language-server launched from %LOCALAPPDATA%, a scoop or npm shim, an IDE plugin host — passing an init.lua or config .lua path they only read. On a developer host this is loud, and it is not an execution of Lua at all."80  - "Applications that embed Lua for scripting or plugins invoking their bundled interpreter with a .lua argument during ordinary use, such as a game's addon loader, Wireshark loading a .lua dissector, or Nmap running a .lua NSE script during authorized scanning."81  - "Developers and CI build agents running Lua test suites or build tooling such as busted and luarocks, which invoke the interpreter directly against .lua files on every build."82  - "Portable or self-contained tools that ship their own copy of lua.exe or luajit.exe outside Program Files, including game mod managers and vendor diagnostic bundles, which match the interpreter branch on every launch."83level: informational

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\lua.exe" or FolderPath endswith "\\lua5.1.exe" or FolderPath endswith "\\lua5.2.exe" or FolderPath endswith "\\lua5.3.exe" or FolderPath endswith "\\lua5.4.exe" or FolderPath endswith "\\lua51.exe" or FolderPath endswith "\\lua52.exe" or FolderPath endswith "\\lua53.exe" or FolderPath endswith "\\lua54.exe" or FolderPath endswith "\\luajit.exe" or FolderPath endswith "\\wlua.exe") or ((ProcessCommandLine endswith ".lua" or ProcessCommandLine endswith ".lua\"") and not (((FolderPath contains "\\program files\\" or FolderPath contains "\\program files (x86)\\" or FolderPath contains "\\windows\\system32\\" or FolderPath contains "\\windows\\syswow64\\") or (FolderPath endswith "\\code.exe" or FolderPath endswith "\\nvim.exe" or FolderPath endswith "\\vim.exe" or FolderPath endswith "\\sublime_text.exe" or FolderPath endswith "\\notepad++.exe" or FolderPath endswith "\\git.exe" or FolderPath endswith "\\rg.exe" or FolderPath endswith "\\findstr.exe" or FolderPath endswith "\\7z.exe" or FolderPath endswith "\\tar.exe" or FolderPath endswith "\\robocopy.exe" or FolderPath endswith "\\xcopy.exe")))))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\lua.exe" OR Image="*\\lua5.1.exe" OR Image="*\\lua5.2.exe" OR Image="*\\lua5.3.exe" OR Image="*\\lua5.4.exe" OR Image="*\\lua51.exe" OR Image="*\\lua52.exe" OR Image="*\\lua53.exe" OR Image="*\\lua54.exe" OR Image="*\\luajit.exe" OR Image="*\\wlua.exe") OR ((CommandLine="*.lua" OR CommandLine="*.lua\"") AND NOT (((Image="*\\program files\\*" OR Image="*\\program files (x86)\\*" OR Image="*\\windows\\system32\\*" OR Image="*\\windows\\syswow64\\*") OR (Image="*\\code.exe" OR Image="*\\nvim.exe" OR Image="*\\vim.exe" OR Image="*\\sublime_text.exe" OR Image="*\\notepad++.exe" OR Image="*\\git.exe" OR Image="*\\rg.exe" OR Image="*\\findstr.exe" OR Image="*\\7z.exe" OR Image="*\\tar.exe" OR Image="*\\robocopy.exe" OR Image="*\\xcopy.exe")))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\lua.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.1.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.2.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.3.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.4.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua51.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua52.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua53.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua54.exe" OR TO_LOWER(process.executable) LIKE "*\\\\luajit.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wlua.exe") OR ((TO_LOWER(process.command_line) LIKE "*.lua" OR TO_LOWER(process.command_line) LIKE "*.lua\"") AND NOT (((TO_LOWER(process.executable) LIKE "*\\\\program files\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\program files (x86)\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\syswow64\\\\*") OR (TO_LOWER(process.executable) LIKE "*\\\\code.exe" OR TO_LOWER(process.executable) LIKE "*\\\\nvim.exe" OR TO_LOWER(process.executable) LIKE "*\\\\vim.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sublime_text.exe" OR TO_LOWER(process.executable) LIKE "*\\\\notepad++.exe" OR TO_LOWER(process.executable) LIKE "*\\\\git.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\findstr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7z.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\robocopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\xcopy.exe")))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="3">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\lua\.exe$|\\lua5\.1\.exe$|\\lua5\.2\.exe$|\\lua5\.3\.exe$|\\lua5\.4\.exe$|\\lua51\.exe$|\\lua52\.exe$|\\lua53\.exe$|\\lua54\.exe$|\\luajit\.exe$|\\wlua\.exe$)</field>    <description>Lua interpreter executed or a .lua script passed to a binary (1/2)</description>    <mitre>      <id>T1059.011</id>    </mitre>  </rule>   <rule id="100001" level="3">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\.lua$|\.lua&quot;$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\program files\\|\\program files \(x86\)\\|\\windows\\system32\\|\\windows\\syswow64\\)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\code\.exe$|\\nvim\.exe$|\\vim\.exe$|\\sublime_text\.exe$|\\notepad\+\+\.exe$|\\git\.exe$|\\rg\.exe$|\\findstr\.exe$|\\7z\.exe$|\\tar\.exe$|\\robocopy\.exe$|\\xcopy\.exe$)</field>    <description>Lua interpreter executed or a .lua script passed to a binary (2/2)</description>    <mitre>      <id>T1059.011</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: informational
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a9af0bd9-f1e0-4e70-94d2-f116301d5637

ATT&CKT1059.011

T1059.011Lua

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.011, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific filters for known legitimate Lua applications or tools
Modify the filter_installed_path to include additional directories where legitimate Lua executables may be installed
Consider adding a filter for specific CommandLine arguments that are known to be used by legitimate Lua scripts
Add a field to track the ParentImage to help filter out Lua processes spawned by legitimate parent processes

Declared by the author

Any non-interpreter process invoked with a .lua path as its last command-line argument that is not one of the named editors or content tools in the filter — antivirus and EDR content scanners walking the filesystem, other text editors and IDEs, backup and file-sync utilities such as rsync-for-Windows or rclone, and archivers not named in the filter. This is the dominant, undisclosed noise source for the untethered branch: it never executed as Lua, it only named a .lua path.
Editors, package managers and Lua language servers installed under a user profile rather than Program Files — Neovim or lua-language-server launched from %LOCALAPPDATA%, a scoop or npm shim, an IDE plugin host — passing an init.lua or config .lua path they only read. On a developer host this is loud, and it is not an execution of Lua at all.
Applications that embed Lua for scripting or plugins invoking their bundled interpreter with a .lua argument during ordinary use, such as a game's addon loader, Wireshark loading a .lua dissector, or Nmap running a .lua NSE script during authorized scanning.
Developers and CI build agents running Lua test suites or build tooling such as busted and luarocks, which invoke the interpreter directly against .lua files on every build.
Portable or self-contained tools that ship their own copy of lua.exe or luajit.exe outside Program Files, including game mod managers and vendor diagnostic bundles, which match the interpreter branch on every launch.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the execution of a Lua interpreter or a Lua script being passed to a binary, which could indicate malicious activity such as scripting or automation of attacks. What separates this from normal activity is the specific focus on Lua, which is not as commonly used as other scripting languages, and the rule's attempt to filter out legitimate uses of Lua.

02 · Telemetry you need

Log source: process creation
Specific fields: Image, CommandLine
Audit setting: process creation logging must be enabled, which may be off by default in some environments

03 · How the logic works

The rule works by selecting processes that match certain conditions: either the process image ends with a Lua executable name (e.g. lua.exe, luajit.exe), or the command line ends with a .lua file extension and the process image does not match certain filters. The filters exclude processes that are installed in standard program files directories or are known content editing tools (e.g. code.exe, nvim.exe). If either the Lua interpreter selection or the script argument selection (with filters applied) is true, the rule triggers.

04 · Common false positives

Legitimate Lua-based applications or games that use Lua scripting
Developers or power users who use Lua for automation or scripting tasks
Tools like git.exe or rg.exe that may be used with Lua scripts in a non-malicious context, but are not filtered out by the rule's current filters

05 · Detection maturity

tier_1: The rule as written may generate a high volume of false positives due to its broad filtering criteria and lack of context around the process execution.
tier_2: With additional filtering and tuning, the rule can become more effective at detecting malicious Lua script execution, but may still require manual review to distinguish between legitimate and malicious activity.
tier_3: Correlating this rule with other signals, such as network or file access anomalies, can help to increase the confidence in detecting malicious activity and reduce the noise generated by legitimate Lua usage.

Related detections4 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/a9af0bd9-f1e0-4e70-94d2-f116301d5637

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Lua interpreter executed or a .lua script passed to a binary

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it