Suspicious LuaJIT Payload Execution (FakeGit Campaign)
Detects the execution of LuaJIT or renamed variants with a single text, log, or JSON file as an argument, a pattern characteristic of the FakeGit campaign's loader. The rule specifically looks for process creation events where the executable name is one of the known suspicious processes (luajit.exe, lua.exe, vm_s390x.exe, init.exe, luad.exe, gcc.exe) and the command line contains a .txt, .log, or .json file extension. It further refines the detection by checking if the command line has a limited number of arguments (2 or 3), which is typical for the malware's simple execution pattern.
Microsoft Sentinel (KQL)
