Lua Script Payload Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects the delivery of a Lua script payload via HTTP. It specifically looks for HTTP responses containing '.lua' in the URI and the string 'os.execute(' within the file data, indicating an attempt to execute commands on the client system. This is often associated with trojan activity.