Potential Arbitrary Command Execution via WSL (wsl.exe) on Windows

Alerts when wsl.exe is launched with execution-focused options that may enable arbitrary Linux/Windows command execution.

FreeUnreviewedSigmamediumv1

potential-arbitrary-command-execution-via-wsl-wsl-exe-on-windows-dec44ca7

title: Potential Arbitrary Command Execution via WSL (wsl.exe) on Windows
id: 10dff39f-90c0-4154-889d-42f1ed6320aa
related:
  - id: 2267fe65-0681-42ad-9a6d-46553d3f3480
    type: similar
  - id: dec44ca7-61ad-493c-bfd7-8819c5faa09b
    type: derived
status: test
description: This rule flags process creation on Windows where wsl.exe is invoked with command-line options consistent with executing specific commands inside a WSL environment. Abuse of WSL for command execution can help attackers blend into legitimate Windows tooling while running Linux userland or shell commands. The detection relies on process creation telemetry, matching wsl.exe by image/original filename and inspecting the command line for execution-related parameters and mounted Windows paths.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
  - https://twitter.com/nas_bench/status/1535431474429808642
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wsl_arbitrary_command_execution.yml
author: oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-05
modified: 2023-04-12
tags:
  - attack.execution
  - attack.stealth
  - attack.t1218
  - attack.t1202
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wsl.exe
    - OriginalFileName: wsl.exe
  selection_cli:
    CommandLine|contains:
      - " -e "
      - " --exec"
      - " --system"
      - " --shell-type "
      - " /mnt/c"
      - " --user root"
      - " -u root"
      - --debug-shell
  filter_main_kill:
    ParentImage|endswith: \cmd.exe
    CommandLine|contains|all:
      - " -d "
      - " -e kill "
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Automation and orchestration scripts may use this method to execute scripts etc.
  - Legitimate use by Windows to kill processes opened via WSL (example VsCode WSL server)
level: medium
license: DRL-1.1

What it detects

This rule flags process creation on Windows where wsl.exe is invoked with command-line options consistent with executing specific commands inside a WSL environment. Abuse of WSL for command execution can help attackers blend into legitimate Windows tooling while running Linux userland or shell commands. The detection relies on process creation telemetry, matching wsl.exe by image/original filename and inspecting the command line for execution-related parameters and mounted Windows paths.

Known false positives

Automation and orchestration scripts may use this method to execute scripts etc.
Legitimate use by Windows to kill processes opened via WSL (example VsCode WSL server)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.