Detectionhighexperimental

Suspicious WSL InstallLocation Registry Key Modification Via CommandLine

Detects the use of reg.exe or PowerShell to modify the WSL InstallLocation registry key via command-line arguments. Legitimate modifications to this key are performed exclusively by the Windows Installer (msiexec.exe) during WSL package installation or update. Manual use of reg.exe or PowerShell to set this value strongly indicates an attempt to redirect WSL execution to a malicious binary.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Tue May 05f9f62824-de4e-40ca-afe7-8358f76a876dwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\reg.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
              - 'reg.exe'
    selection_cli_action:
        CommandLine|contains:
            - ' add '           # reg.exe add subcommand
            - 'New-ItemProperty'
            - 'Set-ItemProperty'
            - 'sp '             # PowerShell alias for Set-ItemProperty
    selection_cli_key:
        CommandLine|contains:
            - '\Lxss\MSI'
            - '/Lxss/MSI'       # forward-slash variant sometimes used with PowerShell paths
    selection_cli_value:
        CommandLine|contains: 'InstallLocation'
    condition: all of selection_*

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0005 · Stealth TA0112 · Defense Impairment TA0003 · Persistence

Techniques

T1112 · Modify Registry T1218 · System Binary Proxy Execution

Related Rules

SimilarDetectionmedium

Potential WSL InstallLocation Registry Key Modification

Detects modifications to the Windows Subsystem for Linux (WSL) InstallLocation registry key. Attackers can modify this registry key to redirect the execution flow of legitimate WSL processes (wsl.exe or bash.exe) to a malicious payload, acting as a proxy execution and defense evasion technique.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

f9f62824-de4e-40ca-afe7-8358f76a876d

Status

experimental

Level

high

Type

Detection

Created

Tue May 05

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_wsl_installlocation_modification_via_cmdline.yml

Raw Tags

attack.stealthattack.defense-impairmentattack.persistenceattack.t1112attack.t1218

View on GitHub