ATT&CK technique
View on MITRE ATT&CK →
T1059.011
Lua
Execution
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Base64 Decoded Payload Piped to Interpreter | production | 2026-10-09 |
| elastic | Suspicious React Server Child Process | production | 2026-10-09 |
| elastic | Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell) | production | 2026-10-06 |
| elastic | Potential Hex Payload Execution via Common Utility | production | 2026-10-05 |
| elastic | Potential Reverse Shell via UDP | production | 2026-09-18 |
| elastic | Process Spawned from Message-of-the-Day (MOTD) | production | 2026-09-18 |
| elastic | Web Server Potential Command Injection Request | production | 2026-09-18 |
| elastic | Decoded Payload Piped to Interpreter Detected via Defend for Containers | production | 2026-09-18 |
| elastic | Suspicious Interpreter Execution Detected via Defend for Containers | production | 2026-09-18 |
| elastic | Deprecated - Unusual Process Spawned from Web Server Parent | deprecated | 2026-07-02 |