---
title: Suspicious Lua Interpreter Execution
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of Lua interpreters (lua.exe, luac.exe, wluac.exe) on non-development endpoints. Fast16 utilizes Lua for payload execution and simulation tampering.
references:
  - https://thehackernews.com/2026/05/pre-stuxnet-fast16-malware-tampered.html
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.execution
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\lua.exe'
      - '\luac.exe'
      - '\wluac.exe'
  filter_legitimate_dev:
    ParentImage|contains:
      - '\Visual Studio'
      - '\JetBrains'
      - '\IDE'
  condition: selection and not filter_legitimate_dev
falsepositives:
  - Authorized software development
  - Legitimate scientific tools that bundle Lua (requires tuning)
level: high
---
title: Fast16 Hook Engine Behavior - Process Access Injection
id: 9b3c2d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects potential hook engine activity indicative of Fast16. Hook engines often require specific process access rights (PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION) to inject code into target simulation processes.
references:
  - https://thehackernews.com/2026/05/pre-stuxnet-fast16-malware-tampered.html
author: Security Arsenal
date: 2026/05/20
tags:
  - attack.defense_evasion
  - attack.t1055.002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    GrantedAccess|contains:
      - '0x020A'
      - '0x0010'
      - '0x0020'
      - '0x0008'
      - '0x143A' # Common aggressive injection mask
    CallTrace|contains:
      - 'UNKNOWN' # Often hooking frameworks obscure the source
  filter_security:
    SourceImage|contains:
      - '\Program Files'
      - '\Windows\\System32'
  condition: selection and not filter_security
falsepositives:
  - Antivirus or EDR scanning processes
  - Legitimate debugging tools
level: medium

// Hunt for Fast16 Indicators: Lua processes and unexpected process injection
// Look for Lua processes spawned by non-standard parents
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ('lua.exe', 'luac.exe', 'wluac.exe')
| where InitiatingProcessFileName !in~ ('explorer.exe', 'cmd.exe', 'powershell.exe', 'Code.exe', 'devenv.exe')
| extend FullLaunchCommand = ProcessCommandLine
| project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName, FullLaunchCommand
| order by Timestamp desc
;
// Correlate with signs of process injection (aggressive access rights)
DeviceProcessEvents
| where ActionType == "ProcessAccessGranted"
| where GrantedAccess contains "0x1F0FFF" or GrantedAccess contains "0x143A" or GrantedAccess contains "0x020A"
| where InitiatingProcessFileName !contains "Program Files"
| project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName, GrantedAccess
| order by Timestamp desc

// Velociraptor VQL: Hunt for Lua artifacts and suspicious memory regions
-- 1. Hunt for Lua executables running on the system
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'lua'
   OR Exe =~ 'lua'

-- 2. Hunt for .lua script files in user directories or temp paths
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/**/*.lua')
WHERE FullPath NOT =~ '/Program Files/'
  AND FullPath NOT =~ '/System32/'

-- 3. Hunt for processes with injected memory segments (heuristic)
SELECT Pid, Name, StartTime
FROM pslist()
WHERE
  -- Fast16 hook engine might manipulate memory protections
  regex("^RW.*", .Protections)  -- Hunting for Read-Write-Execute pages (potential shellcode)
LIMIT 50

# PowerShell: Fast16 Remediation and Hunt Script
# Checks for running Lua processes and suspicious Lua files in user profiles

Write-Host "[+] Starting Fast16 Hunt and Remediation Script..." -ForegroundColor Cyan

# 1. Identify Suspicious Lua Processes
Write-Host "[*] Checking for running Lua interpreters..." -ForegroundColor Yellow
$suspiciousProcesses = Get-Process | Where-Object { 
    $_.ProcessName -match 'lua' -and 
    $_.Path -notlike "*Program Files*" -and 
    $_.Path -notlike "*Windows*" 
}

if ($suspiciousProcesses) {
    Write-Host "[!] ALERT: Suspicious Lua processes found:" -ForegroundColor Red
    $suspiciousProcesses | Format-Table Id, ProcessName, Path, StartTime -AutoSize
    
    # Remediation: Kill Process
    foreach ($proc in $suspiciousProcesses) {
        try {
            Stop-Process -Id $proc.Id -Force -ErrorAction Stop
            Write-Host "[+] Terminated process ID: $($proc.Id)" -ForegroundColor Green
        } catch {
            Write-Host "[-] Failed to terminate process ID: $($proc.Id) - $_" -ForegroundColor Red
        }
    }
} else {
    Write-Host "[-] No suspicious Lua processes found." -ForegroundColor Gray
}

# 2. Scan for Lua Scripts in non-standard directories
Write-Host "[*] Scanning user profiles for .lua files..." -ForegroundColor Yellow
$luaFiles = Get-ChildItem -Path "C:\Users" -Filter "*.lua" -Recurse -ErrorAction SilentlyContinue

if ($luaFiles) {
    Write-Host "[!] ALERT: Found Lua scripts in user directories:" -ForegroundColor Red
    $luaFiles | Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize
    
    # Remediation: Quarantine (Move to a safe folder)
    $quarantinePath = "C:\Quarantine\Fast16"
    if (!(Test-Path $quarantinePath)) { New-Item -ItemType Directory -Path $quarantinePath | Out-Null }
    
    foreach ($file in $luaFiles) {
        $dest = "$quarantinePath\$($file.Name)"
        Move-Item -Path $file.FullName -Destination $dest -Force
        Write-Host "[+] Quarantined: $($file.FullName)" -ForegroundColor Green
    }
} else {
    Write-Host "[-] No suspicious Lua files found." -ForegroundColor Gray
}

Write-Host "[+] Script completed." -ForegroundColor Cyan


━━━ END DETECTION CONTENT ━━━

# Remediation

If Fast16 or similar Lua-based hook engines are suspected within your environment, immediate containment and data validation are required. The primary risk here is **corruption of intellectual property and simulation data**, which cannot be solved by merely removing the malware.

**1. Immediate Isolation:**