title: Suspicious WSL Binary Hijack via Proxy Execution
id: 88d306e9-8e2d-4025-9768-28757d2732db
status: experimental
description: |
    Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations.
    When WSL or bash is invoked, the System32 stub (wsl.exe) looks up the InstallLocation registry key and executes the wsl.exe found there.
    An attacker who modifies InstallLocation to a controlled path causes the stub to transparently proxy execution to a malicious payload,
    which then appears as a wsl.exe child of the legitimate System32 stub.
references:
    - https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
    - https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
    - https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
    - https://learn.microsoft.com/en-us/windows/wsl/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-05-05
tags:
    - attack.stealth
    - attack.t1036.005
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\System32\wsl.exe'
        Image|endswith: '\wsl.exe'
    filter_main_legit_paths_1:
        Image:
            - 'C:\Windows\System32\wsl.exe'
            - 'C:\Program Files\WSL\wsl.exe'
    filter_main_legit_paths_2:
        Image|startswith:
            - 'C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_'
            - 'C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_'
            - 'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux'
    filter_main_legit_paths_3:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\WindowsApps\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution/info.yml