MITRE ATT&CK / T1059.011
T1059.011
Lua
Description
Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state)Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Platforms
Mitigations
- M1033 — Limit Software Installation
- M1047 — Audit
- M1038 — Execution Prevention
Use our free MITRE ATT&CK lookup tool, or browse the full ATT&CK matrix.
Our coverage
- Ghostwriter Deploys Prometheus Phishing Lures Against Ukraine Government Entities
- CVE-2026-9082: Critical Drupal SQL Injection Under Attack on Thousands of Sites
- YARA-X 1.16.0: Faster Scans, Panic Fixes, and Neovim LSP Support
- MacSync Stealer: Hackers Abuse Google Ads and Claude.ai Chats to Push Mac Malware
- Twelve Critical vm2 Node.js Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution
Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →