Suspicious Lua Script Execution via Alien FFI

Ethan Andrews@eandrews

•updated Mar 2, 2026•2•0•78

Detects the execution of the Lua interpreter with a script that has a .ini extension or the known malicious name 'alien.ini' from the Notepad++ supply chain attack. This TTP was used to load and execute shellcode via the Lua Alien FFI library.