Detectionmediumexperimental

Potential WSL InstallLocation Registry Key Modification

Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)Created Tue May 0583475063-b1c8-4774-9568-69bbda71a539windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\Lxss\MSI\InstallLocation'
    filter_main_legitimate_binary:
        - Details:
              - 'C:\Program Files\WSL'
              - '%ProgramFiles%\WSL'
        - Details|contains:
              - ':\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
              - '\AppData\Local\Microsoft\WindowsApps'
              - '%ProgramFiles%\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
    filter_main_msiexec:
        Image:
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
    condition: selection and not 1 of filter_main_*

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0005 · Stealth TA0112 · Defense Impairment TA0003 · Persistence

Techniques

T1112 · Modify Registry T1218 · System Binary Proxy Execution

Related Rules

SimilarDetectionhigh

Suspicious WSL InstallLocation Registry Key Modification Via CommandLine

Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments. Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update. Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

83475063-b1c8-4774-9568-69bbda71a539

Status

experimental

Level

medium

Type

Detection

Created

Tue May 05

Author

Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/registry/registry_set/registry_set_wsl_installlocation_registry_key_modification.yml

Raw Tags

attack.stealthattack.defense-impairmentattack.persistenceattack.t1112attack.t1218

View on GitHub