Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
4
3
2
1
Contributors
3
2
1
1
1
Categories
6
5
3
2
2
Platforms
7
2
1
Products / Services
3
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects Lua scripts executing system commands for malicious purposes
This rule detects the presence of the string "io.popen(" within HTTP response data. This string is indicative of a Lua script attempting to execute shell commands, which is a common technique used by malware to achieve arbitrary code execution on a compromised system. The rule specifically looks for this pattern in data flowing from the server to the client (flow:to_client), suggesting a malicious script being delivered to a user's browser or an application.
This rule detects the delivery of a Lua script payload via HTTP. It specifically looks for HTTP responses containing '.lua' in the URI and the string 'os.execute(' within the file data, indicating an attempt to execute commands on the client system. This is often associated with trojan activity.
This rule detects suspicious command execution patterns involving the Lua interpreter on Linux systems. It specifically looks for Lua interpreter processes executing commands that run suspicious functions. These functions can be abused by adversaries to execute arbitrary commands, establish network connections, or load dynamic libraries, indicating potential malicious activity.
Detects the execution of LuaJIT or renamed variants with a single text, log, or JSON file as an argument, a pattern characteristic of the FakeGit campaign's loader. The rule specifically looks for process creation events where the executable name is one of the known suspicious processes (luajit.exe, lua.exe, vm_s390x.exe, init.exe, luad.exe, gcc.exe) and the command line contains a .txt, .log, or .json file extension. It further refines the detection by checking if the command line has a limited number of arguments (2 or 3), which is typical for the malware's simple execution pattern.
Detects the execution of the Lua interpreter with a script that has a .ini extension or the known malicious name 'alien.ini' from the Notepad++ supply chain attack. This TTP was used to load and execute shellcode via the Lua Alien FFI library.
Detects the creation of specific files in AppData paths associated with the second and third infection chains of the Notepad++ supply chain attack. These files are related to Lua script execution and DLL sideloading for persistence and execution.
Detects the loading of specific DLLs from AppData paths associated with the Notepad++ supply chain attack. This activity is related to DLL sideloading and Lua script execution techniques used by the threat actor. Sysmon EVID 7 is critical for detecting the library load.
Detects processes loading a Lua library (DLL), which could indicate the execution of an embedded Lua script for post-exploitation. This technique was demonstrated in the LOLMIL (Living Off the Land Models and Inference Libraries) research where an autonomous malware used an embedded Lua interpreter to run dynamically generated code.
Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names.
