Lua Interpreter Suspicious Command Execution

Danny Y@zendannyy

•updated Apr 24, 2026•2•0•131

This rule detects suspicious command execution patterns involving the Lua interpreter on Linux systems. It specifically looks for Lua interpreter processes executing commands that run suspicious functions. These functions can be abused by adversaries to execute arbitrary commands, establish network connections, or load dynamic libraries, indicating potential malicious activity.