BeepRAT LuaJIT FFI Shellcode Load: VirtualAlloc+VirtualProtect+CreateThread from Lua

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the execution of Lua interpreter binaries (LuaJit or lua) spawned from a specific process named 'HFY.exe', which is associated with the BeepRAT dropper. The rule also correlates this execution with suspicious raw disk read activity to identify potential in-memory payload loading or malicious interaction with system files.