Suspicious WSL Binary Hijack via Proxy Execution
Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there. An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload, which then appears as a wsl.exe child of the legitimate System32 stub.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
detection:
selection:
ParentImage: 'C:\Windows\System32\wsl.exe'
Image|endswith: '\wsl.exe'
filter_main_legit_paths_1:
Image:
- 'C:\Windows\System32\wsl.exe'
- 'C:\Program Files\WSL\wsl.exe'
filter_main_legit_paths_2:
Image|startswith:
- 'C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_'
- 'C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_'
- 'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux'
filter_main_legit_paths_3:
Image|startswith: 'C:\Users\'
Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
condition: selection and not 1 of filter_main_*False positives are unlikely for most environments. High confidence detection.
Tactics
Techniques
Sub-techniques