Potential Injection from a LUA Script

api where
  process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode", "unbacked_rwx") and
  process.thread.Ext.call_stack_summary like ("*
| luacom.dll*", "*
| lua?.?.dll*", "*
| lua??.dll*") and
  not process.executable :
               ("?:\\Windows\\System32\\cmd.exe",
                "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe",
                "?:\\Program Files\\dotnet\\dotnet.exe",
                "C:\\Program Files (x86)\\Steam\\steamapps\\common\\Balatro\\Balatro.exe",
                "C:\\Program Files (x86)\\ILLiad\\ILLiadClient.exe") and
  not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("kernel", "Kernel
| *") and
  not process.thread.Ext.call_stack_final_user_module.name in ("Kernel", "Unknown") and
  not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                             ("423bde5692d39b68e38292439962804537e673aebf946c1cc12dcf4f34712939",
                                              "3b3558c408c57be332c9595624f6d49413fe0dd43d3d5fa4626041851f77216a") and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "c:\\program files\\wireshark\\lua??.dll!*") and
  not (process.code_signature.trusted == true and process.code_signature.subject_name == "COJALI SL")