Detectionmediumtest

Windows Binary Executed From WSL

Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Tue Feb 14ed825c86-c009-4014-b413-b76003e33d35windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|re: '[a-zA-Z]:\\'
        CurrentDirectory|contains: '\\\\wsl.localhost' # Note: programs not supporting UNC paths (example: cmd.exe). Will default to another location
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

TA0002 · Execution TA0005 · Defense Evasion

Techniques

T1202 · Indirect Command Execution

Rule Metadata

Rule ID

ed825c86-c009-4014-b413-b76003e33d35

Status

test

Level

medium

Type

Detection

Created

Tue Feb 14

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml

Raw Tags

attack.executionattack.defense-evasionattack.t1202

View on GitHub