Potential Injection from a LUA Script

[rule]
description = "Identifies potential code injection from a LUA script interpreter. This may indicate an attempt to evade defenses."
id = "88c2aeed-e5c1-4e0d-98d4-e22ff972e55b"
license = "Elastic License v2"
name = "Potential Injection from a LUA Script"
os_list = ["windows"]
version = "1.0.10"

query = '''
api where
  process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode", "unbacked_rwx") and
  process.thread.Ext.call_stack_summary like ("*|luacom.dll*", "*|lua?.?.dll*", "*|lua??.dll*") and
  not process.executable :
               ("?:\\Windows\\System32\\cmd.exe",
                "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
                "?:\\Program Files\\dotnet\\dotnet.exe",
                "C:\\Program Files (x86)\\Steam\\steamapps\\common\\Balatro\\Balatro.exe",
                "C:\\Program Files (x86)\\ILLiad\\ILLiadClient.exe") and
  not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("kernel", "Kernel|*") and
  not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                             ("423bde5692d39b68e38292439962804537e673aebf946c1cc12dcf4f34712939",
                                              "3b3558c408c57be332c9595624f6d49413fe0dd43d3d5fa4626041851f77216a") and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "c:\\program files\\wireshark\\lua??.dll!*") and
  not (process.code_signature.trusted == true and process.code_signature.subject_name == "COJALI SL")
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"