Lua
Subtechnique · ATTACK:enterprise:T1059.011
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1059.011",
"title": "Lua",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1059/011",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--afddee82-3385-4682-ad90-eeced33f2d07",
"external_id": "T1059.011",
"domain": "enterprise",
"created": "2024-08-05T18:19:42.201Z",
"modified": "2025-04-15T19:58:57.854Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Kaspersky Lua",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf"
},
{
"source_name": "Lua main page",
"url": "https://www.lua.org/start.html"
},
{
"source_name": "Lua state",
"url": "https://pgl.yoyo.org/luai/i/lua_State"
},
{
"source_name": "Cyphort EvilBunny",
"url": "https://web.archive.org/web/20150311013500/http:/www.cyphort.com/evilbunny-malware-instrumented-lua/"
},
{
"source_name": "PoetRat Lua",
"url": "https://blog.talosintelligence.com/poetrat-update/"
},
{
"source_name": "Lua Proofpoint Sunseed",
"url": "https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ab3e47c-29f4-4c17-b84b-609a91086653
Cyphort EvilBunnyATTACK:enterprise:M1033 → mitigates → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c9ea8d0-d8b4-4ddd-89d8-47d38b057736
ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d5c5cd8-b063-46cd-8863-2c85c392012f
Kaspersky LuaATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--850542ca-92d9-45cb-8c5e-b8b0305adf54
ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--891d4be2-c0d1-48f2-920c-0bd9378ac44e
McAfee RedLine Stealer April 2024ATTACK:enterprise:S1188 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--954b8a2e-4aa8-47db-9971-9b2aad8f035c
CCCS ArcaneDoor 2024 · Cisco ArcaneDoor 2024ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be861f1b-0555-433a-b306-98c3903a566b
ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3c9ddee-8ace-4847-81ea-f7dfb8936d3b
Talos PoetRAT October 2020ATTACK:enterprise:T1059.011 → subtechnique-of → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1c979e0-3bcd-418c-9ab5-f00e92461b4f