Threat intelligence / Technique

Lua

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts ( .lua ), or from Lua-embedded programs (through the struct lua_State ).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts ( .lua ), or from Lua-embedded programs (through the struct lua_State ).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)

9 recorded

Relationships

mitigates

from Audit

Mitigation

mitigates

from Execution Prevention

Mitigation

mitigates

from Limit Software Installation

Mitigation

subtechnique-of

to Command and Scripting Interpreter

Technique

uses

Malware

uses

from Line Runner

Malware

uses

Malware

uses

from RedLine Stealer

Malware

uses

Malware

7 external

References

mitre-attack

T1059.011

Kaspersky Lua

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf

Lua main page

https://www.lua.org/start.html

Lua state

https://pgl.yoyo.org/luai/i/lua_State

Cyphort EvilBunny

https://web.archive.org/web/20150311013500/http:/www.cyphort.com/evilbunny-malware-instrumented-lua/

PoetRat Lua

https://blog.talosintelligence.com/poetrat-update/

Lua Proofpoint Sunseed

https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails