Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution
Alerts when wsl.exe is launched with execution-focused options that may enable arbitrary Linux/Windows command execution.
- Product
- windows
- Category
- process_creation
- Author
- oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2020-10-05
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where wsl.exe is launched with command-line arguments consistent with executing Linux and/or Windows commands (for example, execution flags, shell/debug options, or mounted /mnt/c paths). Attackers commonly abuse WSL as a living-off-the-land mechanism to run commands in a trusted Windows context and blend execution across environments. The detection relies on process image identification for wsl.exe and matching specific command-line substrings, while suppressing a specific cmd.exe-based kill-process pattern to reduce false positives.
Reporting behind it
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
- twitter.comhttps://twitter.com/nas_bench/status/1535431474429808642
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wsl_arbitrary_command_execution.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: WSL (wsl.exe) Used for Arbitrary Command Execution"
id: 10dff39f-90c0-4154-889d-42f1ed6320aa
related:
- id: 2267fe65-0681-42ad-9a6d-46553d3f3480
type: similar
- id: dec44ca7-61ad-493c-bfd7-8819c5faa09b
type: derived
status: test
description: This rule flags Windows process creation events where wsl.exe is launched with command-line arguments consistent with executing Linux and/or Windows commands (for example, execution flags, shell/debug options, or mounted /mnt/c paths). Attackers commonly abuse WSL as a living-off-the-land mechanism to run commands in a trusted Windows context and blend execution across environments. The detection relies on process image identification for wsl.exe and matching specific command-line substrings, while suppressing a specific cmd.exe-based kill-process pattern to reduce false positives.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
- https://twitter.com/nas_bench/status/1535431474429808642
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_wsl_arbitrary_command_execution.yml
author: oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-05
modified: 2023-04-12
tags:
- attack.execution
- attack.stealth
- attack.t1218
- attack.t1202
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \wsl.exe
- OriginalFileName: wsl.exe
selection_cli:
CommandLine|contains:
- " -e "
- " --exec"
- " --system"
- " --shell-type "
- " /mnt/c"
- " --user root"
- " -u root"
- --debug-shell
filter_main_kill:
ParentImage|endswith: \cmd.exe
CommandLine|contains|all:
- " -d "
- " -e kill "
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Automation and orchestration scripts may use this method to execute scripts etc.
- Legitimate use by Windows to kill processes opened via WSL (example VsCode WSL server)
level: medium
license: DRL-1.1