Lua interpreter executed or a .lua script passed to a binary

Siemphony@siemphonyinformationalT1059.011unverified

Two observables for AN0278's "execution of Lua interpreters or scripts (.lua)" on a single process-creation event. The first is a named Lua interpreter as the process image. The second exists because Lua interpreters ship under many names and version suffixes (lua5.1.exe, luajit.exe, or a renamed build) and an image-name list alone is defeated by any name not on it — but a .lua path on a command line only proves that a process referenced the file, not that it executed it, so that branch excludes images under Program Files and System32 and a short list of named editors, version-control and search tools that read .lua files as content. That list is necessarily incomplete — antivirus and EDR content scanners are closed-source and vary by vendor, so no Image allowlist can exclude them, and any other editor, backup tool or file-copy utility not named in the filter survives and matches on nothing more than a .lua path in argv. This branch therefore does not detect Lua execution; it detects "some process was invoked with a .lua path as an argument," and the level below is set for that population, not for the narrower interpreter-usage noise the filter does catch. AN0278's file-drop correlation (Sysmon EventID 11) and its TimeWindow knob describe a join across two event types Sigma cannot express, so only the process-creation event is authored, and a renamed interpreter staged inside Program Files, or Lua embedded through struct lua_State with no separate process at all, produces no match here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0101, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\lua.exe" or FolderPath endswith "\\lua5.1.exe" or FolderPath endswith "\\lua5.2.exe" or FolderPath endswith "\\lua5.3.exe" or FolderPath endswith "\\lua5.4.exe" or FolderPath endswith "\\lua51.exe" or FolderPath endswith "\\lua52.exe" or FolderPath endswith "\\lua53.exe" or FolderPath endswith "\\lua54.exe" or FolderPath endswith "\\luajit.exe" or FolderPath endswith "\\wlua.exe") or ((ProcessCommandLine endswith ".lua" or ProcessCommandLine endswith ".lua\"") and not (((FolderPath contains "\\program files\\" or FolderPath contains "\\program files (x86)\\" or FolderPath contains "\\windows\\system32\\" or FolderPath contains "\\windows\\syswow64\\") or (FolderPath endswith "\\code.exe" or FolderPath endswith "\\nvim.exe" or FolderPath endswith "\\vim.exe" or FolderPath endswith "\\sublime_text.exe" or FolderPath endswith "\\notepad++.exe" or FolderPath endswith "\\git.exe" or FolderPath endswith "\\rg.exe" or FolderPath endswith "\\findstr.exe" or FolderPath endswith "\\7z.exe" or FolderPath endswith "\\tar.exe" or FolderPath endswith "\\robocopy.exe" or FolderPath endswith "\\xcopy.exe")))))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\lua.exe" OR Image="*\\lua5.1.exe" OR Image="*\\lua5.2.exe" OR Image="*\\lua5.3.exe" OR Image="*\\lua5.4.exe" OR Image="*\\lua51.exe" OR Image="*\\lua52.exe" OR Image="*\\lua53.exe" OR Image="*\\lua54.exe" OR Image="*\\luajit.exe" OR Image="*\\wlua.exe") OR ((CommandLine="*.lua" OR CommandLine="*.lua\"") AND NOT (((Image="*\\program files\\*" OR Image="*\\program files (x86)\\*" OR Image="*\\windows\\system32\\*" OR Image="*\\windows\\syswow64\\*") OR (Image="*\\code.exe" OR Image="*\\nvim.exe" OR Image="*\\vim.exe" OR Image="*\\sublime_text.exe" OR Image="*\\notepad++.exe" OR Image="*\\git.exe" OR Image="*\\rg.exe" OR Image="*\\findstr.exe" OR Image="*\\7z.exe" OR Image="*\\tar.exe" OR Image="*\\robocopy.exe" OR Image="*\\xcopy.exe")))))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\lua.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.1.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.2.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.3.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua5.4.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua51.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua52.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua53.exe" OR TO_LOWER(process.executable) LIKE "*\\\\lua54.exe" OR TO_LOWER(process.executable) LIKE "*\\\\luajit.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wlua.exe") OR ((TO_LOWER(process.command_line) LIKE "*.lua" OR TO_LOWER(process.command_line) LIKE "*.lua\"") AND NOT (((TO_LOWER(process.executable) LIKE "*\\\\program files\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\program files (x86)\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\system32\\\\*" OR TO_LOWER(process.executable) LIKE "*\\\\windows\\\\syswow64\\\\*") OR (TO_LOWER(process.executable) LIKE "*\\\\code.exe" OR TO_LOWER(process.executable) LIKE "*\\\\nvim.exe" OR TO_LOWER(process.executable) LIKE "*\\\\vim.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sublime_text.exe" OR TO_LOWER(process.executable) LIKE "*\\\\notepad++.exe" OR TO_LOWER(process.executable) LIKE "*\\\\git.exe" OR TO_LOWER(process.executable) LIKE "*\\\\rg.exe" OR TO_LOWER(process.executable) LIKE "*\\\\findstr.exe" OR TO_LOWER(process.executable) LIKE "*\\\\7z.exe" OR TO_LOWER(process.executable) LIKE "*\\\\tar.exe" OR TO_LOWER(process.executable) LIKE "*\\\\robocopy.exe" OR TO_LOWER(process.executable) LIKE "*\\\\xcopy.exe")))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="3">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\lua\.exe$|\\lua5\.1\.exe$|\\lua5\.2\.exe$|\\lua5\.3\.exe$|\\lua5\.4\.exe$|\\lua51\.exe$|\\lua52\.exe$|\\lua53\.exe$|\\lua54\.exe$|\\luajit\.exe$|\\wlua\.exe$)</field>    <description>Lua interpreter executed or a .lua script passed to a binary (1/2)</description>    <mitre>      <id>T1059.011</id>    </mitre>  </rule>   <rule id="100001" level="3">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\.lua$|\.lua&quot;$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\program files\\|\\program files \(x86\)\\|\\windows\\system32\\|\\windows\\syswow64\\)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\code\.exe$|\\nvim\.exe$|\\vim\.exe$|\\sublime_text\.exe$|\\notepad\+\+\.exe$|\\git\.exe$|\\rg\.exe$|\\findstr\.exe$|\\7z\.exe$|\\tar\.exe$|\\robocopy\.exe$|\\xcopy\.exe$)</field>    <description>Lua interpreter executed or a .lua script passed to a binary (2/2)</description>    <mitre>      <id>T1059.011</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: informational
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a9af0bd9-f1e0-4e70-94d2-f116301d5637

ATT&CKT1059.011

T1059.011Lua

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonscript interpreter execution

script interpreter execution

01 · What this rule detects

Execution through the interpreters that are not PowerShell — the Windows command shell, VBScript and JScript through the Windows Script Host, Python, Node, AutoHotKey and AutoIt — and the related case of code arriving as a library loaded into an existing process rather than as a script at all. PowerShell has its own lesson and its own telemetry story; this category is deliberately the rest, because the rest is where the coverage gaps are. The defining problem is that the log records the interpreter and not the script, so the process name tells you almost nothing and every useful condition is somewhere else in the event.

02 · Telemetry you need

Process creation with the complete, untruncated command line and the parent — Sysmon EventID 1, or Security 4688 with Audit Process Creation plus the command-line inclusion policy; both off by default. Without the command line you know python.exe ran and nothing whatsoever about what it ran
Sysmon EventID 1 OriginalFileName, which comes from the binary's version resource and survives renaming — the one field that still says Cmd.Exe or wscript.exe after someone copies the binary to another name
CurrentDirectory and User on the same event, because the working directory frequently holds the script path when the command line does not
Sysmon EventID 11 (FileCreate) for the script itself — .vbs, .js, .jse, .wsf, .py, .ahk, .au3 written under Temp, AppData, ProgramData, Downloads or a docroot, usually seconds before the interpreter runs it
Sysmon EventID 7 (ImageLoad) with ImageLoaded, Signed and SignatureStatus for the shared-module case, and for spotting scripting engines loading into processes that have no business hosting them. ImageLoad is excluded in most shipped Sysmon configurations on volume grounds, so assume it is off until you have checked the config on a real host
On Linux, auditd SYSCALL/EXECVE records — but note that exe= holds the interpreter, so the script path is in the EXECVE argv fields (a1, a2), which auditd only records if log_format and the rule keep argv, and which many shippers drop before the event reaches the SIEM
Cross-reference: PowerShell script block logging (4104) belongs to the suspicious_powershell lesson, not here — do not rebuild it in this category

03 · How the logic works

Start from the fact that the interpreter is the only guaranteed field and the least informative one. python.exe running is meaningless; half the monitoring agents in your estate ship a Python. The three conditions that carry signal are the script's path, the parent process, and where the script came from. Path: an interpreter executing something under a user-writable directory — Temp, AppData, ProgramData, Downloads, a mounted archive, a docroot — is a different event from the same interpreter running out of its own installation directory. Parent: an Office application, a browser, a mail client, a web server or an archive utility launching an interpreter is the durable detection, and it is the same shape as the Office and initial-access lessons for the same reason. Origin: pair the file-write event with the execution, so the alert carries the fact that the script was created ninety seconds earlier by a download. Then the traps, which are what actually keep rules from firing. On Linux, auditd's exe= field is the interpreter, so a rule matching a tool name never fires when that tool is a shell or Python wrapper — the process is /usr/bin/python3 and the tool name is only an argument. On Windows, cscript //E:vbscript will run a file with any extension you like, so an endswith '.vbs' condition is optional from the attacker's side. The command shell has its own escape hatch: caret insertion and delayed expansion mean w^h^o^a^m^i and %COMSPEC:~-1% execute normally while defeating any substring match, so match the shape of the invocation rather than the command inside it. And AutoHotKey and AutoIt scripts can be compiled into a standalone executable with the interpreter embedded, at which point there is no .ahk and no AutoHotkey.exe anywhere in the event — what is left is an unsigned binary in a user-writable path, which is a different rule.

04 · Common false positives

Windows Installer custom actions, which run VBScript and JScript through msiexec and cmd.exe /c during ordinary software installs and repairs
Group Policy logon and startup scripts, where cscript.exe or cmd.exe executes a .vbs or .cmd file from SYSVOL — a network path, run under a user or SYSTEM context, matching most path-based rules
Vendor agents that ship their own Python or Node runtime and run scripts continuously: configuration management, backup, monitoring, cloud CLIs and endpoint agents all do this from their own program directories
Developers and data analysts on workstations running python.exe, node.exe and shell scripts out of source trees and virtual environments under their own profile, which is by definition a user-writable path
Legacy line-of-business applications built on Windows Script Host that have simply never been rewritten, particularly in finance and manufacturing, often launching wscript.exe from a mapped drive
AutoHotKey and AutoIt used for genuine accessibility, data entry and terminal-emulator macros — usually unsigned, usually in AppData, and frequently deployed by the business without IT's knowledge
Build and test tooling loading unsigned in-house DLLs, and line-of-business applications side-loading their own modules from AppData because that is where their installer put them

05 · Detection maturity

Tier 1 — starting point: Matches interpreter process names and a handful of obvious argument patterns such as an inline -c or -e payload.
Tier 2 — tuned: Requires the script to sit in a user-writable path or the parent to be a document, mail or browser process, with vendor runtimes excluded by full interpreter path and parent service.
Tier 3 — correlated: Correlates the execution with the file-creation event that produced the script and its download origin, and scores on the interpreter, the account and how rare that script is across the fleet.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Anchor the rule on the script path and its directory, not on the interpreter — the interpreter list is short and public, and the path is what separates the vendor agent from the payload
Exclude the SYSVOL script by its full path and the policy that deploys it, rather than removing cscript.exe from the rule; the same applies to the vendor agent, which should be excluded by the full path of both the interpreter and its parent service
For developer workstations, scope by host role rather than filtering the behaviour away everywhere — a Python process under a profile directory means something entirely different on a domain controller
Use OriginalFileName alongside Image so a renamed interpreter still matches, and remember the reverse: matching only OriginalFileName misses a genuinely repackaged binary
Match case-insensitively and allow for quoting, doubled separators and interleaved switches; these command lines are assembled by hand and rarely arrive tidy
Where AutoHotKey or AutoIt is sanctioned, baseline the compiled executables by hash and alert on new ones, since the compiled form removes every other condition you had
If ImageLoad telemetry is affordable at all, scope it to unsigned or invalidly signed modules loading from user-writable paths rather than trying to collect every load

Declared by the author

Any non-interpreter process invoked with a .lua path as its last command-line argument that is not one of the named editors or content tools in the filter — antivirus and EDR content scanners walking the filesystem, other text editors and IDEs, backup and file-sync utilities such as rsync-for-Windows or rclone, and archivers not named in the filter. This is the dominant, undisclosed noise source for the untethered branch: it never executed as Lua, it only named a .lua path.
Editors, package managers and Lua language servers installed under a user profile rather than Program Files — Neovim or lua-language-server launched from %LOCALAPPDATA%, a scoop or npm shim, an IDE plugin host — passing an init.lua or config .lua path they only read. On a developer host this is loud, and it is not an execution of Lua at all.
Applications that embed Lua for scripting or plugins invoking their bundled interpreter with a .lua argument during ordinary use, such as a game's addon loader, Wireshark loading a .lua dissector, or Nmap running a .lua NSE script during authorized scanning.
Developers and CI build agents running Lua test suites or build tooling such as busted and luarocks, which invoke the interpreter directly against .lua files on every build.
Portable or self-contained tools that ship their own copy of lua.exe or luajit.exe outside Program Files, including game mod managers and vendor diagnostic bundles, which match the interpreter branch on every launch.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.011, evaluated against their process_creation events.

Share this rule

/u/siemphony/a9af0bd9-f1e0-4e70-94d2-f116301d5637

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Lua interpreter executed or a .lua script passed to a binary

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it