Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths
Alert on System32 wsl.exe spawning a wsl.exe child process when the child path isn’t in known legitimate WSL locations.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-05-05
- Updated
- 2026-10-03
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags cases where C:\Windows\System32\wsl.exe spawns a child process running an executable that ends with \wsl.exe. It then excludes events where the child wsl.exe matches common legitimate WSL install locations and package/WinSxS paths. This behavior matters because a modified WSL install path can cause proxy-style execution that still appears as wsl.exe activity from the expected System32 stub. The rule relies on Windows process creation telemetry with parent and image path fields.
Reporting behind it
- cardinalops.comhttps://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
- blog.qualys.comhttps://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
- thehackernews.comhttps://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/wsl/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: wsl.exe Child Execution Outside Legitimate WSL Paths"
id: 0c187a87-286e-404f-a870-682c578617ee
status: experimental
description: This rule flags cases where C:\Windows\System32\wsl.exe spawns a child process running an executable that ends with \wsl.exe. It then excludes events where the child wsl.exe matches common legitimate WSL install locations and package/WinSxS paths. This behavior matters because a modified WSL install path can cause proxy-style execution that still appears as wsl.exe activity from the expected System32 stub. The rule relies on Windows process creation telemetry with parent and image path fields.
references:
- https://cardinalops.com/blog/bash-and-switch-hijacking-via-windows-subsystem-for-linux/
- https://blog.qualys.com/vulnerabilities-threat-research/2022/04/20/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-2
- https://www.bleepingcomputer.com/news/security/new-malware-uses-windows-subsystem-for-linux-for-stealthy-attacks/
- https://thehackernews.com/2021/09/new-malware-targets-windows-subsystem.html
- https://learn.microsoft.com/en-us/windows/wsl/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-05-05
tags:
- attack.stealth
- attack.t1036.005
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage: C:\Windows\System32\wsl.exe
Image|endswith: \wsl.exe
filter_main_legit_paths_1:
Image:
- C:\Windows\System32\wsl.exe
- C:\Program Files\WSL\wsl.exe
filter_main_legit_paths_2:
Image|startswith:
- C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_
- C:\Windows\WinSxS\arm64_microsoft-windows-lxss-wsl_
- C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux
filter_main_legit_paths_3:
Image|startswith: C:\Users\
Image|contains: \AppData\Local\Microsoft\WindowsApps\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wsl_binary_hijack_execution/info.yml
license: DRL-1.1
related:
- id: 88d306e9-8e2d-4025-9768-28757d2732db
type: derived