Suspicious Lua Command Execution

[rule]
description = """
This rule monitors for suspicious Lua command executions by detecting the start of a Lua process with a command line
argument that contains keywords commonly used by attackers to execute malicious code. These command line arguments
include operations to execute code, create subprocesses, and encode or decode data.
"""
id = "5383342f-7ddd-46c6-90dc-349499df90f1"
license = "Elastic License v2"
name = "Suspicious Lua Command Execution"
os_list = ["linux"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and
process.executable like ("/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*") and
process.args == "-e" and process.command_line like~ (
  "*os.execute(*", "*io.popen(*", "*load(*", "*loadstring(*", "*dofile(*",
  "*package.loadlib(*", "*base64.decode(*", "*base64.encode(*", "*zlib.inflate(*",
  "*zlib.deflate(*", "*zlib.decompress(*", "*zlib.compress(*", "*socket.bind(*",
  "*socket.connect(*", "*socket.receive(*", "*socket.send(*", "*socket.tcp(*",
  "*socket.udp(*", "*socket.listen(*", "*socket.accept(*", "*net.http.request(*",
  "*net.http.get(*", "*net.http.post(*", "*http.request(*", "*http.get(*", "*http.post(*"
) and not (
  process.parent.name in ("make", "configure") or
  process.command_line in ("lua -e require('cjson')", "lua -e require('socket')") or
  process.command_line like "*no_such_lib*"
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.011"
name = "Lua"
reference = "https://attack.mitre.org/techniques/T1059/011/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"