Merge pull request #2157 from CybercentreCanada/lua_ident

Add identification for Lua

Author: cccs-jh

assemblyline/common/custom.yara

@@ -1519,3 +1519,18 @@ rule text_rdp {
         // Add two optionals, to reduce false positives.
         and 2 of ($optional*)
 }
+
+rule code_lua {
+
+    meta:
+        type = "code/lua"
+
+    strings:
+        $local = "local" fullword
+        $nil = "nil" fullword
+        $end = "end" fullword
+        $then = "then" fullword
+
+    condition:
+        all of them
+}

assemblyline/common/identify_defaults.py

@@ -51,6 +51,7 @@
     "code/java": ".java",
     "code/javascript": ".js",
     "code/jscript": ".js",
+    "code/lua": ".lua",
     "code/pdfjs": ".js",
     "code/perl": ".pl",
     "code/php": ".php",