MITRE ATT&CKsub-technique

T1059.011 Lua

Published 2024-08-05 Modified 2025-04-15 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, Network Devices, Windows, macOS
Version
1.1
Created
2024-08-05

Description

Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State). Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1033 Limit Software Installation mitigation
  • M1038 Execution Prevention mitigation
  • M1047 Audit mitigation

Referenced by MITRE ATT&CK · uses (5)

  • S1240 RedLine Stealer software (malware)
  • S1188 Line Runner software (malware)
  • S0428 PoetRAT software (malware)
  • S0396 EvilBunny software (malware)
  • S0125 Remsec software (malware)

Referenced by Compliance · mitigates (11)

  • CIS-2.3 Address Unauthorized Software CIS Safeguard v8.1
  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References