kevmap

TechniquesT1059.011 › AN0278

AN0278 Analytic 0278

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects execution of Lua interpreters or scripts (.lua), especially when correlated with suspicious parent processes or file drop events, indicating malicious use of embedded scripting.</p>
Detects
T1059.011 Lua
Part of
DET0101 Detection Strategy for Lua Scripting Abuse

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SysmonEventCode=1DC0032 Process Creation
WinEventLog:SysmonEventCode=11DC0039 File Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
ParentProcessNameMay vary depending on delivery vector (e.g., explorer.exe, cmd.exe, rundll32.exe)
TimeWindowUsed to correlate file drop and execution of Lua scripts in close succession.