Detectionhighexperimental
Suspicious WSL Binary Masquerading
Detects execution of masqueraded wsl.exe binary. Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary, bypassing detection based on image name alone and abusing user trust in the WSL process name.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Tue May 05530576ee-3b62-4bce-9a03-9aac6c61788awindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic3 selectors
detection:
selection:
Image|endswith: '\wsl.exe'
filter_main_legit_original:
OriginalFileName: 'wsl.exe'
filter_main_null:
OriginalFileName: null
condition: selection and not 1 of filter_main_*False Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
References
MITRE ATT&CK
Tactics
Techniques
Sub-techniques
Rule Metadata
Rule ID
530576ee-3b62-4bce-9a03-9aac6c61788a
Status
experimental
Level
high
Type
Detection
Created
Tue May 05
Path
rules/windows/process_creation/proc_creation_win_wsl_masquerading.yml
Raw Tags
attack.stealthattack.t1036.005attack.t1218