Suspicious Windows Binary Executed From WSL (via process_creation)

title: Suspicious Windows Binary Executed From WSL (via process_creation)
id: 17c5c60e-9a10-5865-ac6c-21c537908d61
status: stable
description: This rule detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships
references:
    - https://attack.mitre.org/techniques/T1202/
    - Internal Research
author: Huntrule Team
date: 2026-03-18
tags:
    - attack.execution
    - attack.stealth
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|re: '[a-zA-Z]:\\'
        CurrentDirectory|contains: '\\\\wsl.localhost'
    condition: selection
falsepositives:
    - Unknown
level: medium